How to extract dates where no-traffic?

[jp_duraimurugan]

Hi All,

I want to extract the dates for last 1 month where there is no-traffic in my application using splunk query.

Please anyone help on this.

[woodcock]

... | timechart count span=1mon ..., | fillnull value=0 count | where count==0

[somesoni2]

Try something like this. Replace base search in line 1 with your search that fetches your application traffic.

| tstats count WHERE index=_internal sourcetype=splunkd by _time span=1d 
| append 
    [| makeresults 
    | addinfo 
    | eval days=mvrange(relative_time(info_min_time,"@d"),relative_time(info_max_time,"@d")+1,86400) 
    | mvexpand days 
    | eval _time=round(days) 
    | eval count=0 
    | table _time count ] 
| stats max(count) as count by _time

. 

[richgalloway · Accepted solution]

Splunk searches for data that is there and can't find something that isn't there.  You can, however, use the timechart command to count events at intervals.  The command will automatically fill in a zero for each interval without an event.

<<your search for traffic>>
| timechart span=1d count
| where count=0