Splunk Search

How to get the 0 data rows using tstats query?

Path Finder

Original query:


index=app-data  sourcetype=clientapp-code
|rex field=_raw "\Status\:(?<Code>.*?)\|"
|eval Failed=if(Code!=0, "Failed", null())
|bucket _time span=1d
|stats count(Failed) as Fail by _time 



_time Fail
2022-01-22 6
2022-01-23 0
2022-01-24 8
2022-01-25 0
2022-01-26 0
2022-01-27 12
2022-01-28 0
2022-01-29 0

tstats query:


|tstats count where  index=app-data  sourcetype=clientapp-code by PREFIX(status:) _time span=1d
|rename status: as Code
|eval Failed=if(Code!=0, "Failed", null())
|where Code!=0
|stats values(count) by _time



_time Fail
2022-01-22 6
2022-01-24 8
2022-01-27 12


I want to see original query  output  with tstats query but 0 data rows are not showing up in tstats command.
How can i get the 0 data rows using tstats query???

Labels (1)
0 Karma



have you try this makecontinuous?

r. Ismo

0 Karma

Super Champion

@Vani_26 - You forget to do | bucket in your second query.

Try adding either bucket or bin command before stats, similar to your first query.


OR alternatively, you can use timechart command instead of the stats command.

| timechart span=1d sum(count) as Fail


I hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...