https://community.splunk.com/t5/Splunk-Search/How-to-extract-dates-where-no-traffic/m-p/640911#M222064 <P>Hi All,</P> <P>I want to extract the dates for last 1 month where there is no-traffic in my application using splunk query.</P> <P>Please anyone help on this.</P> Fri, 21 Apr 2023 18:18:30 GMT jp_duraimurugan 2023-04-21T18:18:30Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-dates-where-no-traffic/m-p/640911#M222064 <P>Hi All,</P> <P>I want to extract the dates for last 1 month where there is no-traffic in my application using splunk query.</P> <P>Please anyone help on this.</P> Fri, 21 Apr 2023 18:18:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-dates-where-no-traffic/m-p/640911#M222064 jp_duraimurugan 2023-04-21T18:18:30Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-dates-where-no-traffic/m-p/640912#M222065 <P>Splunk searches for data that is there and can't find something that isn't there.&nbsp; You can, however, use the <FONT face="courier new,courier">timechart</FONT> command to count events at intervals.&nbsp; The command will automatically fill in a zero for each interval without an event.</P><P>&nbsp;</P><LI-CODE lang="markup">&lt;&lt;your search for traffic&gt;&gt; | timechart span=1d count | where count=0</LI-CODE><P>&nbsp;</P> Thu, 20 Apr 2023 20:44:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-dates-where-no-traffic/m-p/640912#M222065 richgalloway 2023-04-20T20:44:19Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-dates-where-no-traffic/m-p/640913#M222066 <P>Try something like this. Replace base search in line 1 with your search that fetches your application traffic.</P><LI-CODE lang="markup">| tstats count WHERE index=_internal sourcetype=splunkd by _time span=1d | append [| makeresults | addinfo | eval days=mvrange(relative_time(info_min_time,"@d"),relative_time(info_max_time,"@d")+1,86400) | mvexpand days | eval _time=round(days) | eval count=0 | table _time count ] | stats max(count) as count by _time</LI-CODE><P>.&nbsp;</P> Thu, 20 Apr 2023 20:44:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-dates-where-no-traffic/m-p/640913#M222066 somesoni2 2023-04-20T20:44:28Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-dates-where-no-traffic/m-p/640917#M222067 <P>... | timechart count span=1mon ...,&nbsp;| fillnull value=0 count | where count==0</P> Thu, 20 Apr 2023 22:30:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-dates-where-no-traffic/m-p/640917#M222067 woodcock 2023-04-20T22:30:58Z