topic ITSI distinct count KPI: 0 vs. NULL values? in Splunk ITSI

ITSI distinct count KPI: 0 vs. NULL values?

curtismcginity — Wed, 30 Sep 2020 00:04:13 GMT

I have simple KPI giving a distinct count of a USER_ID field. Assume USER_ID exists for 100% of logged events. Within ITSI, the KPI is configured to "fill gaps in data" with NULL values and an Unknown threshold level.

During a time when no events were logged, the KPI maintained a 0 value (not the NULL value). Is this a bug, or some kind of expected behavior? Any suggestions on a workaround?

Re: ITSI distinct count KPI: 0 vs. NULL values?

VatsalJagani — Tue, 11 Jun 2019 14:36:27 GMT

@curtismcginity - I think if you set that to NULL value it shows the discontinued chart.

Re: ITSI distinct count KPI: 0 vs. NULL values?

RickvdIJ — Tue, 13 Aug 2019 10:29:18 GMT

I have the same issue. I want to continue with the latest available value but the result is 0. If you run, investigate and expand the generated search you see ITSI is performing a: | stats dc(USER_ID) and with a macro it stores the result in a cache.

Statistically, a result of no occurences will result in the value 0.
I'm trying with streamstats, latest/earliest and such but no luck yet.

Re: ITSI distinct count KPI: 0 vs. NULL values?

logankinman99 — Fri, 01 Nov 2019 15:44:56 GMT

I have the exact opposite problem (but the same).
I have it set to show custom value 0 but it just shows Null.

Re: ITSI distinct count KPI: 0 vs. NULL values?

RickvdIJ — Fri, 08 Nov 2019 10:58:28 GMT

Hi,

If you do a (distinct)count of something and there are no matching events, the result is 0.
This is expected behavior imho.

The resulting search is: | stats dc(USER_ID).

Perhaps you can create a counter field, where the result of an existing field is 0 or more. And without events this field will not be there?
eval counterfield=if(USER_ID=="",1,0)

Re: ITSI distinct count KPI: 0 vs. NULL values?

curtismcginity — Thu, 10 Feb 2022 21:29:27 GMT

If you do a (distinct)count of something and there are no matching events, the result is 0.
This is expected behavior imho.

Actually there's a very important distinction to make here. Suppose I ask you, "How many balls are inside the box in the next room?" Consider two scenarios:

You walk into the next room, see the box, look inside, and see nothing.
You walk into the next room and see nothing. No box, no balls; nothing.

These are clearly not the same scenario, and so I would expect different behavior imho. Intuitively, a human would likely respond along the lines of

"Zero!"
"Uhm... there is no box!"

The fundamental issue is that any feasible response to a question implicitly validates the premise(s) of the question. In case 2, we need Splunk to return a result indicating our premise is false. Indeed, the "null value" config exists, at least in part, to make this distinction... assuming it works 😉