topic Re: How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event? in Dashboards & Visualizations

How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event?

vkumar6 — Tue, 29 Sep 2020 13:53:30 GMT

Hi,

How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event?

For this query i m getting N/A, but need 0 is results are N/A

Thanks,
Vijay

Re: How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event?

jkat54 — Sat, 29 Apr 2017 22:19:52 GMT

Add this to the end of your search:

| eval total=if(isnull(total),0,total)

Re: How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event?

vkumar6 — Sat, 29 Apr 2017 22:33:41 GMT

No luck, it is not displaying "0"

Re: How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event?

jkat54 — Sun, 30 Apr 2017 00:38:32 GMT

What visualization are you using? Single value?

Re: How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event?

jkat54 — Sun, 30 Apr 2017 00:47:04 GMT

What are you trying to do here. This search seems all out of whack.

Re: How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event?

jkat54 — Sun, 30 Apr 2017 00:50:12 GMT

I updated my answer too. Please try the new version.

Re: How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event?

vkumar6 — Sun, 30 Apr 2017 00:58:05 GMT

When i add this search | stats count AS total | eval total=if(total=="N/A",0,total) it displays value "0" when there are no results, but her if there is any results, then i m getting wrong count.

Here i need sum count , but when i need sum then search (| eval total=if(total=="N/A",0,total) )is not working. I have this search(| fillnull value="unknown" governance) as well but still no luck

Re: How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event?

jpass — Tue, 29 Sep 2020 13:53:36 GMT

I did it by adding this to the end of my search. your_single_val is changed to whatever field populates your singlevalue.

 | appendpipe [| stats count AS mycount] |
EVAL your_single_val =IF(mycount==0,"NO EVENTS",your_single_val) |

Re: How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event?

vkumar6 — Sun, 30 Apr 2017 18:54:21 GMT

Thanks for your Query.
But i need results of stats sum(count) AS mycount, but this search is not populating single value

Re: How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event?

jpass — Sun, 30 Apr 2017 20:59:54 GMT

Maybe your search is not correct. Can you post some sample event data?

Re: How to get a single value visualization to display "0" instead of "N/A" in splunk dashboard when there is no matching event?

vkumar6 — Tue, 29 Sep 2020 13:53:46 GMT

I m getting below results. In Visuliazation it shows ENGINE values but i need count of ENGINE in Visuliazation

***ENGINE                 count           RootKit
9.850.1008                 2                      2.97.1148 2.972.1127***