Splunk Search

How can I add the current month to a timechart if that current month has no results?

andrewtrobec
Motivator

Hello All,
Assuming the following timechart

| timechart count span=1mon

If there are no results for the current month splunk will omit it completely. This means that if I run the command today (February 5th, 2019), I will have:

_time,count
2018-11,43
2018-12,23
2019-01,65

Instead, what I'd like to have is:

_time,count
2018-11,43
2018-12,23
2019-01,65
2019-02,0

How can I achieve this?

Thank you and best regards,

Andrew

0 Karma

DMohn
Motivator

Try adding a makecontinuous _time span=1mon - this should give you the desired result.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...