How to use stats group by _time without null fields?

[josefa123]

Here is a screenshot of what I do.

How can I remove null fields and put the values side by side? I am using stats table group by _time to get all the metrics but it seems that metrics are not indexed at the same time and result in blank fields. How can I resolve this issue? Thanks

[woodcock · Accepted solution]

The easiest way is to "fudge" the time a bit like this:

Your Original Search up until the stats command here | bucket _time span=5m | stats first (*) AS * BY _time

If you still see some NULL values, keep bumping up 5m until you don't.

[pradeepkumarg]

how does _time look in the above table? you can bucket the events into a specific time range before you do stats . This way all events within that time period are grouped together. Example below which groups all the events in a 5 min window

.. | bucket _time span=5m | stats..