We have a search that runs overnight, updating a summary index for reporting the following day, as follows. tag::eventtype="failure" tag:: eventtype="authentication" tag::eventtype="user" | stats count by host The daytime search reads: index=xx-summary earliest=-2w@w1 latest=-1d search name="overnight-search-name" | eval date=time | convert timeformat="%d-%b-%Y" ctime(date) | stats sum(count) by _time date | fields - _time This search provides input to a report which graphs the results over the given period. Now, as the overnight search searches for authentication events, obviously it does not produce results for hosts which have no such events; and the result is that if there are no authentication failures overnight, there are no stats for any host, and consequently no entry (rather than a zero entry) for that date in the final report. The result is that we have a blank patch in the report which may require investigation to confirm that there were in fact no authentication failures, rather than it being due to e.g. a Splunk collector failure. What I would like to do is to arrange that a day with no authentication failures should be reported by a zero entry for that day, rather than no entry. I'd be grateful for any ideas on how to achieve this. Could I somehow cycle through all hosts using "metadata=hosts"? ... View more