Why are there missing days in the results of my "Month to date" chart search?

[_gkollias]

I have a search where I want to calculate total transaction volumes over time by transaction type. I'm populating results, but I notice there are some days missing. Here is a screen shot:

 http://screencast.com/t/zNVURLk8Je 

Here is the search I am using:

index=foo sourcetype=bar
| bucket span=1d _time
| dedup id
| stats count as volume, latest(transaction_type ) as transaction_type by djarfrrw, _time
| eval _time=strftime(_time, "%m/%d/%Y")
| chart max(volume) over transaction_type by _time usenull=f useother=f

Is there anything in the search that might be causing the missing days?

Thanks in Advance!

[sloshburch · Accepted solution]

If the issue is persisting, I would try writing the search another way to leverage the timechart command. If this works out for you, its more of a native approach and less error-prone than extract the date from the time field. Plus it probably performs faster since its less commands:

index=foo sourcetype=bar id=*
 | dedup id
 | timechart span=1d count as volume, latest(transaction_type ) as transaction_type by djarfrrw

[richgalloway]

Have you verified there are events on those days?

[_gkollias]

yeah...so I removed usenull/other=f and got the daily counts....I guess chart isn't as "smart" as timechart?

[somesoni2]

So do you still have missing dates OR it's resolved?

[_gkollias]

I still see the issue...If i run the search in 7 day increments things look ok...when I use Month to Date things are not populating correctly...not quite sure why.