index=abc
| stats latest(_time) AS Last_time by day
| convert ctime(Last_time)
| sort by Last_time desc
for example,
| Monday | 06/13/2022 13:03:11 |
| Tuesday | 06/13/2022 13:03:11 |
| Wednesday | 06/13/2022 13:03:11 |
| Thursday | 06/13/2022 13:03:11 |
| Friday | 06/12/2022 13:03:11 |
| Saturday | 06/13/2022 13:03:11 |
| Sunday | 06/13/2022 13:03:11 |
I want the search to return 0 // or something else if there was no event today.
| Monday | 06/13/2022 13:03:11 |
| Tuesday | 06/13/2022 13:03:11 |
| Wednesday | 06/13/2022 13:03:11 |
| Thursday | 06/13/2022 13:03:11 |
| Friday | 0 // or something else |
| Saturday | 06/13/2022 13:03:11 |
| Sunday | 06/13/2022 13:03:11 |
Is that possible.
timechart will fill in the blanks in the time line - try something like this
| timechart latest(_time) as latest_time
| fillnull value=0