How to fill the gaps from days with no data in tstats + timechart query?

[Neel881]

Hello,

How to fill the gaps from days with no data in tstats + timechart query?

Query:

| tstats count as Total where index="abc"  by _time, Type span=1d

Getting:

Required:

Please suggest

Thank You

[richgalloway]

Try this.  The timechart command should fill in empty time slots automatically.

| tstats prestats=true count as Total where index="abc"  by _time, Type span=1d
| timechart span=1d cont=true count as Total by Type

[Neel881]

Same output

[ITWhisperer]

Try with fillnull

| tstats count as Total where index="abc"  by _time, Type span=1d
| timechart span=1d max(Total) as Total by Type
| fillnull value=0
| untable _time Type Total

[Neel881]

Fillnull works properly in my case. Thank you!

[ITWhisperer · Accepted solution]

Try something like this

| tstats count as Total where index="abc"  by _time, Type span=1d
| timechart span=1d max(Total) as Total by Type
| untable _time Type Total

[Neel881]

Thank you, Now I am getting correct output but Phase data is missing.

| tstats count as Total where index="abc"  by _time, Type, Phase span=1d
| timechart span=1d max(Total) as Total by Type
| untable _time Type Total

 Phase field is missing in the final table.

I tried to add 'Phase' field in the untable but showing error.

Pls suggest

[Neel881]

Got the solution. Thank you so much.