I need to use tstats vs stats for performance reasons. I would like tstats count to show 0 if there are no counts to display.
| tstats count where index="abc" by _time span=1h
This would return a table with _time (every hour) and count, like this:
_time count
2017-01-01 12:00 50
2017-01-01 13:00 62
2017-01-01 14:00 14
But if the count is zero, it doesn't return that row. How do I get this to display 0 count for that hour?
Thank you.
... View more