Splunk Search

stats count by _time

Path Finder
stats count by _time 

Hi all, I've a query where i count by _time but if in a day there aren't events it is not show in the count. How can i see also a date with zero events? thanks

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

With the stats command, the only series that are created for the group-by clause are those that exist in the data. If you have continuous data, you may want to manually discretize it by using the bucket command before the stats command. If you use span=1d _time, there will be placeholder values created for empty days and all other _time values will be snapped to the day.

All of this is done for you automatically in the timechart command.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

With the stats command, the only series that are created for the group-by clause are those that exist in the data. If you have continuous data, you may want to manually discretize it by using the bucket command before the stats command. If you use span=1d _time, there will be placeholder values created for empty days and all other _time values will be snapped to the day.

All of this is done for you automatically in the timechart command.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!