https://community.splunk.com/t5/Splunk-Search/field-calculation-help/m-p/481827#M193124 <P>didnt understand to which part of my post it is referring to ...</P> Wed, 22 Apr 2020 10:19:14 GMT sarit_s 2020-04-22T10:19:14Z https://community.splunk.com/t5/Splunk-Search/field-calculation-help/m-p/481825#M193122 <P>hello,</P> <P>i have this query:</P> <PRE><CODE>| tstats count as daily_count summariesonly=true allow_old_summaries=true from datamodel="events_prod" by events.eventtype events.tail_id sourcetype _time span=1d | eval day=strftime(_time, "%Y-%m-%d") | multireport [ table daily_count, events.eventtype, day, events.tail_id, sourcetype] [ stats values(events.eventtype) as events.eventtype, values(day) as day, values(events.tail_id) as events.tail_id | mvexpand events.eventtype | mvexpand day | mvexpand events.tail_id | eval daily_count=0 ] | eventstats first(sourcetype) as sourcetype by events.eventtype | stats first(daily_count) as daily_count by events.eventtype, day, events.tail_id, sourcetype |rename day as _time | streamstats sum(daily_count) as general by events.tail_id sourcetype time_window=30d | where general!=0 | streamstats sum(daily_count) as monthly_count by events.eventtype events.tail_id time_window=30d | table events.eventtype, monthly_count </CODE></PRE> <P>which calculate number of events for each eventType for period of 30 days . also its needed to add to the calculation days with no events so i've added to the query days with number of events=0</P> <P>I want to clear from the calculation raws that there is no events from their sourcetype and their tail_id for the last 30 days and clear the raws that their daily calculation = 0 in the empty time period</P> <P>what should i add to my query ?</P> <P>thanks</P> Wed, 22 Apr 2020 09:05:53 GMT https://community.splunk.com/t5/Splunk-Search/field-calculation-help/m-p/481825#M193122 sarit_s 2020-04-22T09:05:53Z https://community.splunk.com/t5/Splunk-Search/field-calculation-help/m-p/481826#M193123 <P><CODE>tstats</CODE> needs <CODE>prestats=t</CODE> option.</P> Wed, 22 Apr 2020 09:14:31 GMT https://community.splunk.com/t5/Splunk-Search/field-calculation-help/m-p/481826#M193123 to4kawa 2020-04-22T09:14:31Z https://community.splunk.com/t5/Splunk-Search/field-calculation-help/m-p/481827#M193124 <P>didnt understand to which part of my post it is referring to ...</P> Wed, 22 Apr 2020 10:19:14 GMT https://community.splunk.com/t5/Splunk-Search/field-calculation-help/m-p/481827#M193124 sarit_s 2020-04-22T10:19:14Z https://community.splunk.com/t5/Splunk-Search/field-calculation-help/m-p/481828#M193125 <P>see reference<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats</A></P> Wed, 22 Apr 2020 10:28:54 GMT https://community.splunk.com/t5/Splunk-Search/field-calculation-help/m-p/481828#M193125 to4kawa 2020-04-22T10:28:54Z