Splunk Search

command stats with full table even if null values

loyslegrand
Path Finder

Hi

Does anyone know how to get as output of a stats command a table with all values even when the result is null to avoid gaps in the table?

" ..... | stats count by date_mday Priority | xyseries date_mday Priority count | fillnull | sort+date_mday"

If there is no entry for one day , the day is skipped.

BRgds

Loys

Tags (1)
1 Solution

MuS
Legend

Hi loyslegrand,

take this run everywhere example and adapt it to your needs:

 index=_internal foo earliest=-30d | timechart span="1d" count | eval date_mday=strftime(_time, "%d") | fields count date_mday

Here the timechart does most of what you want but the date_mday is blank for dates with no data. The eval will recreate this field and finally the fields command cleans the result.

hope this helps to get you started ...

cheers, MuS

View solution in original post

HiroshiSatoh
Champion

Do not work taimechart?
..... | taimechart span=1d count by Priority

0 Karma

MuS
Legend

Hi loyslegrand,

take this run everywhere example and adapt it to your needs:

 index=_internal foo earliest=-30d | timechart span="1d" count | eval date_mday=strftime(_time, "%d") | fields count date_mday

Here the timechart does most of what you want but the date_mday is blank for dates with no data. The eval will recreate this field and finally the fields command cleans the result.

hope this helps to get you started ...

cheers, MuS

MuS
Legend

nice, please mark this as answered by ticking the tick - thx 🙂

0 Karma

loyslegrand
Path Finder

Thanks , it works; as I wanted the count by Priority I have entered :
"index=_internal foo earliest=-30d | timechart span="1d" count by Priority | eval date_mday=strftime(_time, "%d")"
the result is a full table including the null values

Loys

0 Karma

Ayn
Legend

Add fillnull before your stats command.

... | fillnull date_mday | stats count ...

loyslegrand
Path Finder

with fillnull, I have the same result as before
Thanks
Loys

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...