index = itf host="*itseelm*" logLevel=ERROR EbcName=EBCMFSSALES02 ExceptionMessage="*ORA-01000*" | timechart span=1d count | fillnull value=0 count
earliest -90d@d earliest
latest now latest
Give this a try
index = itf host="*itseelm*" logLevel=ERROR EbcName=EBCMFSSALES02 ExceptionMessage="*ORA-01000*"
| append [| noop | addinfo | eval t=split(info_min_time." ".info_max_time," ") | mvexpand t | table t | rename t as _time ]
| timechart span=1d count | fillnull value=0 count
Try this
... | timechart cont=t span=1d count | ...
When I do
<someindexes> <someothercriteria> earliest=-90d | timechart span=1d count
I totally get lines with zero in them. Lots of those, in fact, depending on my search.
Can you confirm exactly what you are seeing? Maybe a screenshot or a paste of a few lines where the data's "missing?"