topic Re: How to get table column headers to display even if no results are found? in Splunk Search

How to get table column headers to display even if no results are found?

bullbo — Thu, 05 Dec 2019 22:01:12 GMT

I have a search that displays new accounts created over the past 30 days and another that displays accounts deleted over the past 30 days.

I would like to have the column (field) names display even if no results are returned as well as the “No results found” message. Is it possible or am I asking too much?

Re: How to get table column headers to display even if no results are found?

woodcock — Fri, 06 Dec 2019 00:13:25 GMT

Assuming that your existing search ends in something like | table _time foo bat, just insert an appendpipe like like this:

| makeresults
| eval foo="bar", bat="baz"

| where true()=false()

| appendpipe [stats count | where count==0 | foreach _time foo bat [eval <>="No Results Found"]]
| table _time foo bat

Re: How to get table column headers to display even if no results are found?

bullbo — Wed, 30 Sep 2020 03:12:10 GMT

Thanks, but doesn't seem to work or I'm doing something wrong (quite possible), here's my query with the appendpipe added. Feel free to let me know what I am probably doing wrong.

index=wineventlog source=wineventlog:security EventCode=4725 OR EventCode=629
| appendpipe [stats count | where count==0 | foreach _time, user, src_user, EventCodeDescription
[eval <>="No Results Found"]]

| table _time, user, src_user, EventCodeDescription

| rename _time as Date, src_user as "Disabled by", user as "User Account", EventCodeDescription as "Event"

| convert ctime(Date)

Re: How to get table column headers to display even if no results are found?

to4kawa — Fri, 06 Dec 2019 13:58:13 GMT

index=wineventlog source=wineventlog:security EventCode=4725 OR EventCode=629
| appendpipe [stats count | where count==0 |eval EventCodeDescription="No Results Found"]
| table _time, user, src_user, EventCodeDescription
| rename _time as Date, src_user as "Disabled by", user as "User Account", EventCodeDescription as "Event"
| convert ctime(Date)

Re: How to get table column headers to display even if no results are found?

bullbo — Fri, 06 Dec 2019 14:30:44 GMT

Perfect, thanks!