https://community.splunk.com/t5/Splunk-Search/Include-row-for-zero-resutls/m-p/39160#M8927 <P>I have several searches that count the number of results per day, using "stats count by date_mday". My problem is that they don't include days with 0 results, which means I have to do a bit of manipulation after running the search.</P> <P>Is there any way of forcing it to include a date entry for days with 0 matches?</P> <P>I was wondering if I could achieve this with timechart and fillnull, but found the documentation (<A href="http://www.splunk.com/base/Documentation/4.2.2/SearchReference/Timechart">http://www.splunk.com/base/Documentation/4.2.2/SearchReference/Timechart</A>) a bit confusing.</P> <P>Thanks.</P> Thu, 07 Jul 2011 10:06:39 GMT lawrenn 2011-07-07T10:06:39Z https://community.splunk.com/t5/Splunk-Search/Include-row-for-zero-resutls/m-p/39160#M8927 <P>I have several searches that count the number of results per day, using "stats count by date_mday". My problem is that they don't include days with 0 results, which means I have to do a bit of manipulation after running the search.</P> <P>Is there any way of forcing it to include a date entry for days with 0 matches?</P> <P>I was wondering if I could achieve this with timechart and fillnull, but found the documentation (<A href="http://www.splunk.com/base/Documentation/4.2.2/SearchReference/Timechart">http://www.splunk.com/base/Documentation/4.2.2/SearchReference/Timechart</A>) a bit confusing.</P> <P>Thanks.</P> Thu, 07 Jul 2011 10:06:39 GMT https://community.splunk.com/t5/Splunk-Search/Include-row-for-zero-resutls/m-p/39160#M8927 lawrenn 2011-07-07T10:06:39Z https://community.splunk.com/t5/Splunk-Search/Include-row-for-zero-resutls/m-p/39161#M8928 <P>Yes you can</P> <PRE><CODE>your search | timechart span="1d" count | eval date_mday=strftime(_time, "%d") | fields count date_mday </CODE></PRE> <P>the timechart does most of what you want but the date_mday is blank for dates with no data so the eval recreates this field and finally the fields command cleans up the result.</P> Thu, 07 Jul 2011 10:43:07 GMT https://community.splunk.com/t5/Splunk-Search/Include-row-for-zero-resutls/m-p/39161#M8928 BobM 2011-07-07T10:43:07Z https://community.splunk.com/t5/Splunk-Search/Include-row-for-zero-resutls/m-p/39162#M8929 <P>Thank you very much for your help</P> Thu, 07 Jul 2011 10:59:24 GMT https://community.splunk.com/t5/Splunk-Search/Include-row-for-zero-resutls/m-p/39162#M8929 lawrenn 2011-07-07T10:59:24Z