topic Re: Help on tstats search? in Splunk Search

How to get the 0 data rows using tstats query?

Vani_26 — Tue, 06 Jun 2023 13:08:33 GMT

Original query:

OUTPUT:

_time	Fail
2022-01-22	6
2022-01-23	0
2022-01-24	8
2022-01-25	0
2022-01-26	0
2022-01-27	12
2022-01-28	0
2022-01-29	0

tstats query:

OUTPUT:

_time	Fail
2022-01-22	6
2022-01-24	8
2022-01-27	12

I want to see original query output with tstats query but 0 data rows are not showing up in tstats command.
How can i get the 0 data rows using tstats query???

Re: Help on tstats search?

VatsalJagani — Tue, 06 Jun 2023 06:09:17 GMT

@Vani_26 - You forget to do | bucket in your second query.

Try adding either bucket or bin command before stats, similar to your first query.

OR alternatively, you can use timechart command instead of the stats command.

| timechart span=1d sum(count) as Fail

I hope this helps!!!

Re: Help on tstats search?

isoutamo — Tue, 06 Jun 2023 07:24:05 GMT

have you try this makecontinuous?

r. Ismo