https://community.splunk.com/t5/Splunk-Search/How-to-display-bucket-histogram-data-with-zero-count/m-p/15543#M1916 <P>I'm trying to run a bucket/histogram of data but I want to display buckets that have zero count. By default, bucket seems to hide those entries.</P> <P>Quick example -- histogram of CPU-load on a group of machines. Each machine logs cpu-load as 'x' every 15min, I pick the latest entry for each host and bucket that data:</P> <P>(search command) |stats first(x) as ff by host |bucket ff bins=10 start=0 end=10 |chart count(ff) over ff</P> <P>Is there a way to tell bucket (or chart) that it should display all bins, even if they are zero-count?</P> Tue, 15 Jun 2010 20:09:12 GMT jbp4444 2010-06-15T20:09:12Z https://community.splunk.com/t5/Splunk-Search/How-to-display-bucket-histogram-data-with-zero-count/m-p/15543#M1916 <P>I'm trying to run a bucket/histogram of data but I want to display buckets that have zero count. By default, bucket seems to hide those entries.</P> <P>Quick example -- histogram of CPU-load on a group of machines. Each machine logs cpu-load as 'x' every 15min, I pick the latest entry for each host and bucket that data:</P> <P>(search command) |stats first(x) as ff by host |bucket ff bins=10 start=0 end=10 |chart count(ff) over ff</P> <P>Is there a way to tell bucket (or chart) that it should display all bins, even if they are zero-count?</P> Tue, 15 Jun 2010 20:09:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-bucket-histogram-data-with-zero-count/m-p/15543#M1916 jbp4444 2010-06-15T20:09:12Z https://community.splunk.com/t5/Splunk-Search/How-to-display-bucket-histogram-data-with-zero-count/m-p/15544#M1917 <P>You should probably just not invoke <CODE>bucket</CODE> at all, and just use <CODE>chart count(ff) over ff bins=10</CODE>, or use <CODE>makecontinuous</CODE> instead of <CODE>bucket</CODE>.</P> Tue, 15 Jun 2010 20:24:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-bucket-histogram-data-with-zero-count/m-p/15544#M1917 gkanapathy 2010-06-15T20:24:25Z https://community.splunk.com/t5/Splunk-Search/How-to-display-bucket-histogram-data-with-zero-count/m-p/15545#M1918 <P>That works exactly how I wanted it -- thanks!</P> Tue, 15 Jun 2010 21:55:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-bucket-histogram-data-with-zero-count/m-p/15545#M1918 jbp4444 2010-06-15T21:55:23Z https://community.splunk.com/t5/Splunk-Search/How-to-display-bucket-histogram-data-with-zero-count/m-p/15546#M1919 <P>Thanks for making me aware of the <CODE>makecontinuous</CODE> command</P> Fri, 24 Feb 2017 23:07:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-bucket-histogram-data-with-zero-count/m-p/15546#M1919 helge 2017-02-24T23:07:15Z