https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240959#M71628 <P>Have you verified there are events on those days?</P> Thu, 21 Jan 2016 18:06:16 GMT richgalloway 2016-01-21T18:06:16Z https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240958#M71627 <P>I have a search where I want to calculate total transaction volumes over time by transaction type. I'm populating results, but I notice there are some days missing. Here is a screen shot:</P> <PRE><CODE> <A href="http://screencast.com/t/zNVURLk8Je" target="test_blank">http://screencast.com/t/zNVURLk8Je</A> </CODE></PRE> <P>Here is the search I am using:</P> <PRE><CODE>index=foo sourcetype=bar | bucket span=1d _time | dedup id | stats count as volume, latest(transaction_type ) as transaction_type by djarfrrw, _time | eval _time=strftime(_time, "%m/%d/%Y") | chart max(volume) over transaction_type by _time usenull=f useother=f </CODE></PRE> <P>Is there anything in the search that might be causing the missing days?</P> <P>Thanks in Advance!</P> Thu, 21 Jan 2016 17:52:43 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240958#M71627 _gkollias 2016-01-21T17:52:43Z https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240959#M71628 <P>Have you verified there are events on those days?</P> Thu, 21 Jan 2016 18:06:16 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240959#M71628 richgalloway 2016-01-21T18:06:16Z https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240960#M71629 <P>yeah...so I removed usenull/other=f and got the daily counts....I guess chart isn't as "smart" as timechart?</P> Thu, 21 Jan 2016 18:10:18 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240960#M71629 _gkollias 2016-01-21T18:10:18Z https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240961#M71630 <P>So do you still have missing dates OR it's resolved?</P> Thu, 21 Jan 2016 18:37:43 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240961#M71630 somesoni2 2016-01-21T18:37:43Z https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240962#M71631 <P>I still see the issue...If i run the search in 7 day increments things look ok...when I use Month to Date things are not populating correctly...not quite sure why. </P> Thu, 21 Jan 2016 18:43:24 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240962#M71631 _gkollias 2016-01-21T18:43:24Z https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240963#M71632 <P>If the issue is persisting, I would try writing the search another way to leverage the timechart command. If this works out for you, its more of a native approach and less error-prone than extract the date from the time field. Plus it probably performs faster since its less commands:</P> <PRE><CODE>index=foo sourcetype=bar id=* | dedup id | timechart span=1d count as volume, latest(transaction_type ) as transaction_type by djarfrrw </CODE></PRE> Thu, 21 Jan 2016 19:38:19 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-there-missing-days-in-the-results-of-my-quot-Month-to/m-p/240963#M71632 sloshburch 2016-01-21T19:38:19Z