How to fill count number of previous month when there is no data?

[boxmetal]

Hi Splunk community,

I have a chart display the number of users in each month. There was no data coming in in October and November, and I want to show the number of September for October and November for the chart to have a continuous trend.

Here's my query:

<my search>
| timechart span=1mon dc(UserID) as "Number of Users"

The current chart looks like this:

[scelikok]

Hi @boxmetal,

You can try below;

<my search>
| timechart span=1mon dc(UserID) as "Number of Users" 
| filldown

[boxmetal · Accepted solution]

This also needs additional steps to set the zero values to null in the timechart

https://community.splunk.com/t5/Splunk-Search/Timechart-filldown/m-p/521182

<my search>
| timechart span=1mon dc(UserID) as Count
| eval Count=if(Count==0, NULL, Count)
| filldown

[yuanliu]

Check out this great answer from @somesoni2: https://community.splunk.com/t5/Deployment-Architecture/How-to-produce-empty-time-buckets/m-p/172323