topic Re: How to display zero count in a stats table? in Splunk Search

How to display zero count in a stats table?

IRHM73 — Tue, 17 Jul 2018 08:56:02 GMT

Hi, I wonder whether someone may be able to help me please.

I'm using the following stats query.

`wso2_wmf(RequestCompleted)`
| dedup eventId
| stats count by request.detailContext

The problem I have is that it's not displaying zero values for the request.detail.Context field.

If I use '| fillnull value=0' then specify each value from the request.detail.Context field then it does display those values with a zero count.

But the problem with this, is that because I'm being prescriptive in field values, when new field values are being ingested into Splunk for this field, they are not being extracted in the stats table.

I've looked at every post I could find of a similar nature and the solutions provided haven't worked. Could someone perhaps have a look at this and offer some guidance on how I may go about achieving this.

Many thanks and kind regards

Chris

Re: How to display zero count in a stats table?

MuS — Tue, 17 Jul 2018 09:18:16 GMT

Might not be the answer, but an idea how to handle the case where the base search does not return events .... read here : https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html

cheers, MuS

Re: How to display zero count in a stats table?

woodcock — Tue, 17 Jul 2018 13:07:54 GMT

This is the Sentinel Search problem discussed (with solution) here:
https://conf.splunk.com/session/2015/conf2015-LookupTalk.pdf

Re: How to display zero count in a stats table?

IRHM73 — Tue, 17 Jul 2018 13:17:25 GMT

Many thanks @woodcock.

Re: How to display zero count in a stats table?

IRHM73 — Tue, 17 Jul 2018 13:18:26 GMT

Hi @MuS. Doesn't quite work for my circumstances, but it does seem to be a common issue.

Thank you for taking the time to reply.

Many thanks and kind regards

Chris

Re: How to display zero count in a stats table?

woodcock — Tue, 17 Jul 2018 13:20:33 GMT

Don't thank me, thank @duckfez! 😆 Maybe he will comment and you can UpVote him.

Re: How to display zero count in a stats table?

IRHM73 — Tue, 17 Jul 2018 13:24:01 GMT

Hopefully he will, so can give him the credit aswell.