I have this search thar returns the data from the last 10 days. index="raw_eg8" earliest=-10d@d latest=now() | search "evento.ORIGEM_EVENTO" = "FileService" | search "evento.STATUS" = "PROCESSADO" | search "evento.SIGLA"="CB4" | spath "evento.SIGLA"| bucket _time span=1d | eval DayOfWeekC=strftime(_time, "%a") | eval DayOfWeekN=strftime(_time, "%m-%d-%Y") | table "evento.SIGLA", DayOfWeekC, DayOfWeekN, | stats count by "evento.SIGLA" , DayOfWeekN | eventstats sum(count) AS Total by "evento.SIGLA" | eval avg= Total/count| sort DayOfWeekN desc And then i got this results. But, as you can see, in 10-05-2020 there is no data. How can I return count = 0 when there is no data? Like evento.SIGLA DayOfWeekN count Total avg CB4 10-05-2020 0 8 8
... View more