Splunk Search

How can I show all x-axis labels , even result is zero with timechart command

nagarjuna280
Communicator

I want data for the last ten months, but few months doesn't have data,I am using
| timechart span=1mon count
then I am not able to see labels (months) with empty spaces. showing only, labels which has data.

I want all labels(months) event result is zero

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

This makes no sense, filling in blank spots is fundamental to what timechart does. Take a look at this run-anywhere example that proves that it fills in gaps where there is no data:

index=_* date_minute>20 | timechart span=1m count

View solution in original post

woodcock
Esteemed Legend

This makes no sense, filling in blank spots is fundamental to what timechart does. Take a look at this run-anywhere example that proves that it fills in gaps where there is no data:

index=_* date_minute>20 | timechart span=1m count
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

[Puzzles] Solve, Learn, Repeat: Nested loops in Event Conversion

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...