Show a message even when no events are returned using Sttats with by clause

rkmaggidi — Wed, 30 Sep 2020 03:54:04 GMT

Hi All,

I have situation where I want to show a message instead of empty cell.

I am using below query to get some data:

somesearch | rex field=msg "ErrorCode\\":(?\d+)"

| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by cf_app_name, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status + " (" + noOfInstances +")"
| table cf_app_name, Core,Status
| eval {Core}=Status
| fields - Core, Status
| stats values() as * by cf_app_name

and getting results in as shown in below image

here for some of the components I don't have any events in splunk. So I want to show it as down. how can I achieve this ?

Thank in advance.

Re: Show a message even when no events are returned using Sttats with by clause

richgalloway — Thu, 23 Jan 2020 12:59:54 GMT

Try ... | fillnull value="DOWN".

Re: Show a message even when no events are returned using Sttats with by clause

rkmaggidi — Fri, 24 Jan 2020 05:22:18 GMT

Thank you very much.

topic Show a message even when no events are returned using Sttats with by clause in Splunk Search

Show a message even when no events are returned using Sttats with by clause

Re: Show a message even when no events are returned using Sttats with by clause

Re: Show a message even when no events are returned using Sttats with by clause