https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155282#M43690 <P>yes you are right. But when i use timechart, i don't get the date format in the way i want (month-day) and also when i chart it, it skips showing some of the dates (even though data points are there)</P> Thu, 24 Jul 2014 03:06:13 GMT xvxt006 2014-07-24T03:06:13Z https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155280#M43688 <P>Hi,</P> <P>i am charting errors and i see that for some of the days there is no data and i want to fill that date with 0. So i have used this query. I see that i have 0s when there are no actual values. But in the chart, i see actual values on the x axis and date values as the data points. How to flip this so that i see date on the x axis and actual data on the data points..</P> <P>| gentimes start=06/23/2014 end=07/23/2014 increment=1d | fields starttime | eval Date=strftime(starttime," %m-%d") | eval Errors= 0 | fields 404s,Date | join type=outer Date[search xxxxx | eval Date=strftime(_time," %m-%d") | chart count(uri) as Errors over Date | sort by Date]</P> Wed, 23 Jul 2014 23:01:21 GMT https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155280#M43688 xvxt006 2014-07-23T23:01:21Z https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155281#M43689 <P>Looks like your use case is: Chart count of errors over date (with span as 1 day) and when there is no data you should show it as 0. <BR /> Is there any specific reason to use join?</P> Thu, 24 Jul 2014 02:11:47 GMT https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155281#M43689 strive 2014-07-24T02:11:47Z https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155282#M43690 <P>yes you are right. But when i use timechart, i don't get the date format in the way i want (month-day) and also when i chart it, it skips showing some of the dates (even though data points are there)</P> Thu, 24 Jul 2014 03:06:13 GMT https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155282#M43690 xvxt006 2014-07-24T03:06:13Z https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155283#M43691 <P>Hello,</P> <P>Could you try to use "timechart" instead of "chart"?</P> <PRE><CODE>xxxxxx | timechart span=1d count(uri) AS Errors | eval Date=strftime(_time," %m-%d") | table Date Errors </CODE></PRE> <P>I believe it would be simple.</P> <P>I hope it helps you. Thank you.</P> Thu, 24 Jul 2014 03:39:54 GMT https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155283#M43691 Suda 2014-07-24T03:39:54Z https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155284#M43692 <P>Thank you. i did not know that having table would still show the chart</P> Thu, 24 Jul 2014 03:49:32 GMT https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155284#M43692 xvxt006 2014-07-24T03:49:32Z https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155285#M43693 <P>You want to see the chart (historical graph), don't you?<BR /> If you stop "timechart" command, you may see the timechart.<BR /> Is it an answer which you want?</P> Thu, 24 Jul 2014 03:53:42 GMT https://community.splunk.com/t5/Splunk-Search/chart-with-missing-values/m-p/155285#M43693 Suda 2014-07-24T03:53:42Z