Add zero value when using _time field

[whitefang1726]

When using stats count on searches, it does not show zero values on specific time intervals.

Example:
index=main sourcetype=test (event=eventA OR eventB)
| bin _time span=1h
| stats count by _time, event

Sample Result:

_time Event count
04/27 1:00AM EventA 10
04/27 2:00AM EventA 10
04/27 1:00AM EventB 10

How can I show row with zero value? 
_time Event count
04/27 1:00AM EventA 10
04/27 2:00AM EventA 10
04/27 3:00AM EventA 0
04/27 1:00AM EventB 10
04/27 2:00AM EventB 0
04/27 3:00AM EventB 0

[richgalloway]

The stats command will not fill in missing values, but timechart will.

index=main sourcetype=test (event=eventA OR eventB)
| timechart span=1h count by event

[whitefang1726]

I was expecting a non-timechart command, but that works. Better than creating long queries. 😄

Thanks!

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.