There are several ways to do this. A traditional method is to backfill every day. index IN (index1, index2, index3, index4)
| bin span=1d _time
| chart count _time over index
| append
[ makeres...
See more...
There are several ways to do this. A traditional method is to backfill every day. index IN (index1, index2, index3, index4)
| bin span=1d _time
| chart count _time over index
| append
[ makeresults
| timechart span=1d@d count
| fields - count]
| stats values(*) as * by _time
| fillnull Note I replaced your last line with fillnull. (This command is worth learning.) Another somewhat sneaky way to do this depends on the real stats you perform. If it is simple stats such as count, you can just "sneak in" something that always have some value, such as index _internal. index IN (index1, index2, index3, index4, _internal)
| bin span=1d _time
| chart count _time over index
| fields - VALUE_internal
| fillnull