topic How to add zeros to table when data is not found in Splunk Search

How to add zeros to table when data is not found

komalg — Wed, 11 Dec 2019 19:53:05 GMT

Hello,

Have a question for the community: I have a table that looks like this:
ADate Type
2019-12-01 ABC
2019-12-02 ABC
2019-12-02 XYZ
2019-12-03 XYZ

When I run ..... |stats count by A , Type- I get only the counts of Types that are there on that date.

I want to append the count of 2019-12-01 for XYZ as 0 , 2019-12-03 ABC as 0 like that in my result.
Any help with this?

Thanks.

DavidHourani — Wed, 11 Dec 2019 20:32:33 GMT

Hi @komalg,

You can use the fillnull command as follows to put zeros everywhere (just like my school grades) in case your search is |stats count by A:

... | fillnull

But if you want to use |stats count by ADate, Type- then you're actually better off going for something like this :

...| eval _time=strptime(ADate,%Y-%m-%d) |timechart count by Type

Let me know if that helps.

Cheers,
David

komalg — Mon, 30 Dec 2019 16:32:30 GMT

Thanks, stats does not work, but I am able to work with timechart.