I have a dataset which I cannot use timechart because i'm splitting by two fields. Not all of the values of message have events in all time buckets. Is there a way to add 0 time buckets for each of value of message?
index=myindex msg_severity=* | bucket span=1m _time | stats count by message msg_severity _time
↧