stats count by _time

[pinzer]

stats count by _time 

Hi all, I've a query where i count by _time but if in a day there aren't events it is not show in the count. How can i see also a date with zero events? thanks

[Dan · Accepted solution]

With the stats command, the only series that are created for the group-by clause are those that exist in the data. If you have continuous data, you may want to manually discretize it by using the bucket command before the stats command. If you use span=1d _time, there will be placeholder values created for empty days and all other _time values will be snapped to the day.

All of this is done for you automatically in the timechart command.