Splunk Search

How can I add the current month to a timechart if that current month has no results?

andrewtrobec
Motivator

Hello All,
Assuming the following timechart

| timechart count span=1mon

If there are no results for the current month splunk will omit it completely. This means that if I run the command today (February 5th, 2019), I will have:

_time,count
2018-11,43
2018-12,23
2019-01,65

Instead, what I'd like to have is:

_time,count
2018-11,43
2018-12,23
2019-01,65
2019-02,0

How can I achieve this?

Thank you and best regards,

Andrew

0 Karma

DMohn
Motivator

Try adding a makecontinuous _time span=1mon - this should give you the desired result.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...