Return 0 when there is no data.

[justeso1]

I have this search thar returns the data from the last 10 days.

index="raw_eg8" earliest=-10d@d latest=now()
| search "evento.ORIGEM_EVENTO" = "FileService" | search "evento.STATUS" = "PROCESSADO" | search "evento.SIGLA"="CB4" | spath "evento.SIGLA"| bucket _time span=1d
| eval DayOfWeekC=strftime(_time, "%a")
| eval DayOfWeekN=strftime(_time, "%m-%d-%Y")
| table "evento.SIGLA", DayOfWeekC, DayOfWeekN, | stats count by "evento.SIGLA" , DayOfWeekN | eventstats sum(count) AS Total by "evento.SIGLA" | eval avg= Total/count| sort DayOfWeekN desc 

And then i got this results. But, as you can see, in 10-05-2020 there is no data. 

How can I return count = 0 when there is no data? 

Like 

evento.SIGLA DayOfWeekN count Total avg

CB4

10-05-2020

0

8

8

justeso1_0-1602083442632.png

[ashajambagi]

Hi @justeso1 ,

Try using  | fillnull

https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Fillnull