When using stats count on searches, it does not show zero values on specific time intervals.
Example:
index=main sourcetype=test (event=eventA OR eventB)
| bin _time span=1h
| stats count by _time, event
Sample Result:
_time Event count
04/27 1:00AM EventA 10
04/27 2:00AM EventA 10
04/27 1:00AM EventB 10
How can I show row with zero value?
_time Event count
04/27 1:00AM EventA 10
04/27 2:00AM EventA 10
04/27 3:00AM EventA 0
04/27 1:00AM EventB 10
04/27 2:00AM EventB 0
04/27 3:00AM EventB 0
The stats command will not fill in missing values, but timechart will.
index=main sourcetype=test (event=eventA OR eventB)
| timechart span=1h count by event
I was expecting a non-timechart command, but that works. Better than creating long queries. 😄
Thanks!
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.