https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/163067#M46279 <P>Hello,</P> <P>I'm trying to get the statistics of the bytes transferred each day with a query like this:</P> <PRE><CODE> | tstats prestats=t sum(bytes) from datamodel=DM earliest=-7d@d latest=@d by _time span=1d | timechart span=1d sum(bytes) as "Bytes" </CODE></PRE> <P>And the results are something like this, skipping the days with no data:</P> <PRE><CODE>_time Bytes 2015-06-16 5509565371 2015-06-17 15556005605 2015-06-18 15556685676 2015-06-19 9722873606 </CODE></PRE> <P>What I need is to fill the days with no data with 0s, something like this:</P> <PRE><CODE>_time Bytes 2015-06-15 0 2015-06-16 5509565371 2015-06-17 15556005605 2015-06-18 15556685676 2015-06-19 9722873606 2015-06-20 0 2015-06-21 0 </CODE></PRE> <P>How could I make that possible without lowering the performance?</P> Mon, 22 Jun 2015 10:55:15 GMT mciudad 2015-06-22T10:55:15Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/163067#M46279 <P>Hello,</P> <P>I'm trying to get the statistics of the bytes transferred each day with a query like this:</P> <PRE><CODE> | tstats prestats=t sum(bytes) from datamodel=DM earliest=-7d@d latest=@d by _time span=1d | timechart span=1d sum(bytes) as "Bytes" </CODE></PRE> <P>And the results are something like this, skipping the days with no data:</P> <PRE><CODE>_time Bytes 2015-06-16 5509565371 2015-06-17 15556005605 2015-06-18 15556685676 2015-06-19 9722873606 </CODE></PRE> <P>What I need is to fill the days with no data with 0s, something like this:</P> <PRE><CODE>_time Bytes 2015-06-15 0 2015-06-16 5509565371 2015-06-17 15556005605 2015-06-18 15556685676 2015-06-19 9722873606 2015-06-20 0 2015-06-21 0 </CODE></PRE> <P>How could I make that possible without lowering the performance?</P> Mon, 22 Jun 2015 10:55:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/163067#M46279 mciudad 2015-06-22T10:55:15Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/163068#M46280 <P>It should already be doing that (that is what it <EM>does</EM>) but just in case try adding <CODE>cont=t</CODE>. In either case, <EM>DEFINITELY</EM> open a support ticket to report this bug.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Timechart">http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Timechart</A></P> Mon, 22 Jun 2015 13:11:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/163068#M46280 woodcock 2015-06-22T13:11:14Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/163069#M46281 <P>Thank you, you were right! </P> <P>What if there is no data in any day? In that case it returns "No results found. " but it should return just 0 bytes per day.</P> Mon, 22 Jun 2015 14:20:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/163069#M46281 mciudad 2015-06-22T14:20:53Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/163070#M46282 <P>According to the dox and every usage I have ever tried, <CODE>timechart</CODE> will fill in any empty <CODE>span</CODE> slots with 0-values, as long as <CODE>cont=t</CODE> (which is the default).</P> Mon, 22 Jun 2015 14:41:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/163070#M46282 woodcock 2015-06-22T14:41:02Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/163071#M46283 <P>I see it was answered to be done using timechart, but how to do the same with tstats.<BR /> tstats does not show a record for dates with missing data...</P> <P>the fillnull_value option also does not work on 726 version.</P> Mon, 13 Jan 2020 06:32:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-the-gaps-from-days-with-no-data-in-tstats-timechart/m-p/163071#M46283 jiaqya 2020-01-13T06:32:02Z