fillcontinuous

fillcontinuous is a custom search command that makes sparse time-series results complete. It adds a row for every combination of time bucket and group-by values that is missing from your results, so every series has a value in every bucket. The situation it addresses is a familiar one. Splunk fills time gaps for you only when you group by a single field: "timechart span=1h count by host" works because timechart pivots that one field into a column per value. The moment you need a second dimension - host and sourcetype, service and status, index and source - you fall back to bin plus stats, and stats simply returns nothing for a bucket in which nothing happened. Those absent rows are not harmless. An average taken across the result is an average over only the buckets that happened to contain data, which is not the average you asked for. A threshold alert quietly skips the intervals with no events, which are frequently the intervals worth knowing about. And how a chart renders the hole is decided by the panel's null handling rather than by your data, so the same result can read as a gap in one place and a drop to zero in another. makecontinuous, the built-in command for densifying a series, does not solve this. It fills along a single dimension and has no concept of group-by fields, so given multi-dimensional results it inserts one valueless row per missing bucket rather than one row per series - and it reports no error while doing so, leaving you with a result that looks plausible and is wrong. fillcontinuous keys on the whole set of group-by fields at once. Add it after bin and stats, and every combination that appears in your data gets a row in every bucket, with 0 - or a value you choose - where there was nothing. It can also mark which rows it added, extend the grid to cover an entire search window rather than just the range that contained events, and infer the span from the data if you would rather not state it. The command is registered as fillcontinuous, with fillgaps as a shorter alias. It runs on the search head only, collects no data, and needs no configuration.