topic Re: How to display all data sets for each time bucket combined with join, append or appendcols when data for one data set is missing? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-display-all-data-sets-for-each-time-bucket-combined-with/m-p/142404#M39520 <P>What's the query you're executing?</P> Wed, 03 Dec 2014 22:29:15 GMT somesoni2 2014-12-03T22:29:15Z How to display all data sets for each time bucket combined with join, append or appendcols when data for one data set is missing? https://community.splunk.com/t5/Splunk-Search/How-to-display-all-data-sets-for-each-time-bucket-combined-with/m-p/142402#M39518 <P>I would like to see the following</P> <P>_time Data1 Data2<BR /> 2014-10-01 22 1<BR /> 2014-10-02 32 8<BR /> 2014-10-03 46 -<BR /> 2014-10-04 54 10</P> <P>However when ever I'm using join / append / appendcols I only get the following. The time bucket with no data for one of the Data sets causes the entire bucket not display.</P> <P>_time Data1 Data2<BR /> 2014-10-01 22 1<BR /> 2014-10-02 32 8<BR /> 2014-10-04 54 10</P> <P>I have tried fillnull and other methods but I can't get it to work. It seems quite a straight forward thing to do, I think I am missing something.</P> <P>Hope you can Help!</P> Wed, 03 Dec 2014 16:27:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-all-data-sets-for-each-time-bucket-combined-with/m-p/142402#M39518 DanielFordWA 2014-12-03T16:27:43Z Re: How to display all data sets for each time bucket combined with join, append or appendcols when data for one data set is missing? https://community.splunk.com/t5/Splunk-Search/How-to-display-all-data-sets-for-each-time-bucket-combined-with/m-p/142403#M39519 <P>I suspect you're using <CODE>join</CODE> to combine Data1 and Data2 right? If that's the case, are you using the option <CODE>type=left</CODE>?</P> <P>This option basically tells the <CODE>join</CODE> keep events even if there is no match on the subsearch. By default <CODE>join</CODE> uses <CODE>type=inner</CODE>, which means that only joined events will be kept.</P> Wed, 03 Dec 2014 21:22:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-all-data-sets-for-each-time-bucket-combined-with/m-p/142403#M39519 musskopf 2014-12-03T21:22:14Z Re: How to display all data sets for each time bucket combined with join, append or appendcols when data for one data set is missing? https://community.splunk.com/t5/Splunk-Search/How-to-display-all-data-sets-for-each-time-bucket-combined-with/m-p/142404#M39520 <P>What's the query you're executing?</P> Wed, 03 Dec 2014 22:29:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-all-data-sets-for-each-time-bucket-combined-with/m-p/142404#M39520 somesoni2 2014-12-03T22:29:15Z Re: How to display all data sets for each time bucket combined with join, append or appendcols when data for one data set is missing? https://community.splunk.com/t5/Splunk-Search/How-to-display-all-data-sets-for-each-time-bucket-combined-with/m-p/142405#M39521 <P>Thanks for this. I resolved the issues now.</P> Thu, 18 Dec 2014 09:57:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-all-data-sets-for-each-time-bucket-combined-with/m-p/142405#M39521 DanielFordWA 2014-12-18T09:57:52Z