Splunk Search

Fill missing values from stats command

aohls
Contributor

I am using a bin of 10 minutes with stats for the past hour. What I am running into is that when doing so not all items in my stats command have a count for one of the buckets. For example one might show up for the 10, 20, 40 minute buckets but, I want to the 30 and 50 minute buckets to show blank values. What is the best way to accomplish this? Fillnull does not work for this since there is no null value, the value just is not showing at all.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Depending on what statistics you producing, you may be able to replace stats with timechart, which automatically fills in missing time periods.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...