I need show any value in every minute, but I only get value > 0
Search:
| tstats count WHERE index=XXXXX C_TXN_A IN (1,2) C_TXN_B IN (1)
((C_TXN_C IN (1,2,3,5) AND C_TXN_D IN (5,6)) OR (NOT C_TXN_C IN (4,6) AND C_TXN_D IN (7,8)))
by _time span=1m
| sort _time
After that, I get:
2020-10-29 10:45:00 47
2020-10-29 10:40:00 12
But I want to get:
2020-10-29 10:45:00 47
2020-10-29 10:44:00 0
2020-10-29 10:43:00 0
2020-10-29 10:42:00 0
2020-10-29 10:41:00 0
2020-10-29 10:45:00 12
How to do it?
The timechart command will do that.
| tstats prestats=t count WHERE index=XXXXX C_TXN_A IN (1,2) C_TXN_B IN (1)
((C_TXN_C IN (1,2,3,5) AND C_TXN_D IN (5,6)) OR (NOT C_TXN_C IN (4,6) AND C_TXN_D IN (7,8)))
by _time span=1m
| timechart span=1m count
You helped me however I improved your idea:
|timechart span=1m sum(count)
|fillnull