Splunk Search

## Show count 0 on tstats with index name for multiple indexes

Path Finder

I have a search:

`| tstats count WHERE earliest=-2d@-3h latest=now index=* by index, _time | makecontinuous span=1h _time | eval count=if(isnull(count),0,count)`

where the count is shown as 0 if there is no data, however I get an empty field for the index at that specific time. How can I search for every hour and every index and if index Y does not have any count to show:

index _time &nbsp count
Y 2017-09-03 00:00 0

Tags (5)
1 Solution
Revered Legend

Give this a try

``````| tstats count WHERE earliest=-2d@-3h latest=now index=* by index, _time span=1h | timechart sum(count) as count by index limit=0 | fillnull value=0 | untable _time index count
``````
Revered Legend

Give this a try

``````| tstats count WHERE earliest=-2d@-3h latest=now index=* by index, _time span=1h | timechart sum(count) as count by index limit=0 | fillnull value=0 | untable _time index count
``````
Path Finder

thanks! that actually works but any idea why if I go back more than 4 days I lose the hour portion of the _time?

``````| tstats count WHERE earliest=-5d@-3h latest=now index=* by index, _time span=1h | timechart sum(count) as count by index limit=0 | fillnull value=0 | untable _time index count
``````

when I do that, time only shows the dates. Realistically I am going back -30 days

Revered Legend

My bad. I didn't set the span in timechart command so it was doing auto span based on number of points (which will be higher with longer timerange), try this version

``````| tstats count WHERE earliest=-5d@-3h latest=now index=* by index, _time span=1h | timechart span=1h sum(count) as count by index limit=0 | fillnull value=0 | untable _time index count
``````
Path Finder

Perfect! thank you

The Latest From the Splunk Community!