https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174837#M50172 <P>Hi loyslegrand,</P> <P>take this run everywhere example and adapt it to your needs:</P> <PRE><CODE> index=_internal foo earliest=-30d | timechart span="1d" count | eval date_mday=strftime(_time, "%d") | fields count date_mday </CODE></PRE> <P>Here the <CODE>timechart</CODE> does most of what you want but the <CODE>date_mday</CODE> is blank for dates with no data. The <CODE>eval</CODE> will recreate this field and finally the <CODE>fields</CODE> command cleans the result.</P> <P>hope this helps to get you started ...</P> <P>cheers, MuS</P> Thu, 22 May 2014 07:11:23 GMT MuS 2014-05-22T07:11:23Z https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174835#M50170 <P>Hi</P> <P>Does anyone know how to get as output of a stats command a table with all values even when the result is null to avoid gaps in the table?</P> <P>" ..... | stats count by date_mday Priority | xyseries date_mday Priority count | fillnull | sort+date_mday"</P> <P>If there is no entry for one day , the day is skipped.</P> <P>BRgds</P> <P>Loys</P> Mon, 28 Sep 2020 16:41:32 GMT https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174835#M50170 loyslegrand 2020-09-28T16:41:32Z https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174836#M50171 <P>Add <CODE>fillnull</CODE> before your <CODE>stats</CODE> command.</P> <PRE><CODE>... | fillnull date_mday | stats count ... </CODE></PRE> Thu, 22 May 2014 07:06:09 GMT https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174836#M50171 Ayn 2014-05-22T07:06:09Z https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174837#M50172 <P>Hi loyslegrand,</P> <P>take this run everywhere example and adapt it to your needs:</P> <PRE><CODE> index=_internal foo earliest=-30d | timechart span="1d" count | eval date_mday=strftime(_time, "%d") | fields count date_mday </CODE></PRE> <P>Here the <CODE>timechart</CODE> does most of what you want but the <CODE>date_mday</CODE> is blank for dates with no data. The <CODE>eval</CODE> will recreate this field and finally the <CODE>fields</CODE> command cleans the result.</P> <P>hope this helps to get you started ...</P> <P>cheers, MuS</P> Thu, 22 May 2014 07:11:23 GMT https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174837#M50172 MuS 2014-05-22T07:11:23Z https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174838#M50173 <P>Do not work taimechart?<BR /> ..... | taimechart span=1d count by Priority</P> Thu, 22 May 2014 07:14:11 GMT https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174838#M50173 HiroshiSatoh 2014-05-22T07:14:11Z https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174839#M50174 <P>with fillnull, I have the same result as before <BR /> Thanks<BR /> Loys</P> Thu, 22 May 2014 09:16:30 GMT https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174839#M50174 loyslegrand 2014-05-22T09:16:30Z https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174840#M50175 <P>Thanks , it works; as I wanted the count by Priority I have entered :<BR /> "index=_internal foo earliest=-30d | timechart span="1d" count by Priority | eval date_mday=strftime(_time, "%d")" <BR /> the result is a full table including the null values</P> <P>Loys</P> Mon, 28 Sep 2020 16:41:37 GMT https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174840#M50175 loyslegrand 2020-09-28T16:41:37Z https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174841#M50176 <P>nice, please mark this as answered by ticking the tick - thx <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 22 May 2014 09:21:54 GMT https://community.splunk.com/t5/Splunk-Search/command-stats-with-full-table-even-if-null-values/m-p/174841#M50176 MuS 2014-05-22T09:21:54Z