Chart including no results

[jacqu3sy]

I'm trying to create a chart showing activity from May through until now, knowing that the activity ceased some months ago. I want the chart to continue  showing a flat line of zero from the time the activity stopped, rather than just stopping back in August.

How would I tweak the following query to include the ceased traffic?

earliest=05/01/2020:00:00:01 latest=now
index=nix sourcetype="nix" src_user=JohnD host=server1 
| bin _time span=1w
| stats count by _time, host

Thanks.

[ITWhisperer · Accepted solution]

The timechart command will generate the empty results for you

earliest=05/01/2020:00:00:01 latest=now
index=nix sourcetype="nix" src_user=JohnD host=server1 
| timechart span=1w count by host

[jacqu3sy]

Simple as that! great, thanks.