https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658030#M227292 <P>Try this.&nbsp; The <FONT face="courier new,courier">timechart </FONT>command should fill in empty time slots automatically.</P><LI-CODE lang="markup">| tstats prestats=true count as Total where index="abc" by _time, Type span=1d | timechart span=1d cont=true count as Total by Type</LI-CODE><P>&nbsp;</P> Tue, 19 Sep 2023 16:54:11 GMT richgalloway 2023-09-19T16:54:11Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658009#M227282 <P>Hello,</P><P>How to fill the gaps from days with no data in tstats + timechart query?</P><P><STRONG>Query: </STRONG></P><P>| tstats count as Total where index="abc"&nbsp; by _time, Type span=1d</P><P><STRONG>Getting:</STRONG></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Neel881_0-1695132638207.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27232iA237BB04A6276090/image-size/medium?v=v2&amp;px=400" role="button" title="Neel881_0-1695132638207.png" alt="Neel881_0-1695132638207.png" /></span></P><P><FONT color="#000000"><STRONG>Required:</STRONG></FONT></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Neel881_1-1695132682156.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27233i3120493BA768DE78/image-size/medium?v=v2&amp;px=400" role="button" title="Neel881_1-1695132682156.png" alt="Neel881_1-1695132682156.png" /></span></P><P>&nbsp;</P><P>Please suggest</P><P>&nbsp;</P><P>Thank You</P><P>&nbsp;</P> Tue, 19 Sep 2023 14:13:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658009#M227282 Neel881 2023-09-19T14:13:09Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658018#M227286 <P>Try something like this</P><LI-CODE lang="markup">| tstats count as Total where index="abc" by _time, Type span=1d | timechart span=1d max(Total) as Total by Type | untable _time Type Total</LI-CODE> Tue, 19 Sep 2023 15:17:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658018#M227286 ITWhisperer 2023-09-19T15:17:37Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658023#M227288 <P>Same output</P> Tue, 19 Sep 2023 16:08:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658023#M227288 Neel881 2023-09-19T16:08:04Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658024#M227289 <P>Try with fillnull</P><LI-CODE lang="markup">| tstats count as Total where index="abc" by _time, Type span=1d | timechart span=1d max(Total) as Total by Type | fillnull value=0 | untable _time Type Total</LI-CODE> Tue, 19 Sep 2023 16:26:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658024#M227289 ITWhisperer 2023-09-19T16:26:46Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658030#M227292 <P>Try this.&nbsp; The <FONT face="courier new,courier">timechart </FONT>command should fill in empty time slots automatically.</P><LI-CODE lang="markup">| tstats prestats=true count as Total where index="abc" by _time, Type span=1d | timechart span=1d cont=true count as Total by Type</LI-CODE><P>&nbsp;</P> Tue, 19 Sep 2023 16:54:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658030#M227292 richgalloway 2023-09-19T16:54:11Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658098#M227324 <P>Thank you, Now I am getting correct output but Phase data is missing.</P><LI-CODE lang="markup">| tstats count as Total where index="abc" by _time, Type, Phase span=1d | timechart span=1d max(Total) as Total by Type | untable _time Type Total</LI-CODE><P>&nbsp;Phase field is missing in the final table.</P><P>I tried to add 'Phase' field in the untable but showing error.</P><P>&nbsp;</P><P>Pls suggest</P> Wed, 20 Sep 2023 09:12:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658098#M227324 Neel881 2023-09-20T09:12:09Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658099#M227325 <P>Got the solution. Thank you so much.</P> Wed, 20 Sep 2023 09:21:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658099#M227325 Neel881 2023-09-20T09:21:16Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658100#M227326 <P>Fillnull works properly in my case. Thank you!</P><P>&nbsp;</P> Wed, 20 Sep 2023 09:22:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/658100#M227326 Neel881 2023-09-20T09:22:05Z