Splunk Search

How to get timechart value even if splunk contain no data for this "_time" field ?

Path Finder

Hi,

I'm tryin to get the number of alerts by day.

When i have alerts i see the number in statistics. But when i don't received errors in a day. i don't see the _time value of this day.

For example we are the 2019-04-23. My last alert was the 2019-04-17. I want to see :

_time                            count
2019-04-17                  9
2019-04-18                  0
2019-04-19                  0
2019-04-20                  0
2019-04-21                  0
2019-04-22                  0
2019-04-23                  0
0 Karma
1 Solution

Path Finder

The following search works for me :

index=main earliest="01/01/2019:00:00:00"| ... | append [| streamstats count | eval count=0] | timechart span=1d count

View solution in original post

0 Karma

Path Finder

The following search works for me :

index=main earliest="01/01/2019:00:00:00"| ... | append [| streamstats count | eval count=0] | timechart span=1d count

View solution in original post

0 Karma

Esteemed Legend

If you use timechart, by default, it creates empty buckets. Many other commands have a makecontinuous=true argument to do the same thing. We cannot help better because you did not give us your search SPL.

0 Karma