topic Re: Show results of stats count when result is 0 in Splunk Search

Show results of stats count when result is 0

tromero3 — Fri, 21 Aug 2020 22:13:42 GMT

I have a search using stats count but it is not showing the result for an index that has 0 results. There is two columns, one for Log Source and the one for the count. I'd like to show the count of EACH index, even if there is 0 result.

example

log source count
A 20
B 10
C 0

index=A or index=B or index=C | eval "Log Source"=case(index == "A", "indexA", index == "B", "indexB", index == "C", "IndexC") | stats count by "Log Source"

Re: Show results of stats count when result is 0

jorjiana88 — Fri, 21 Aug 2020 19:12:12 GMT

fillnull

Re: Show results of stats count when result is 0

tromero3 — Fri, 21 Aug 2020 19:19:14 GMT

already tried that, it doesn't work

Re: Show results of stats count when result is 0

to4kawa — Fri, 21 Aug 2020 20:29:47 GMT

your sample is "index=A" , so it's difficult to use split() for actually log, I guess. you can do it.

Re: Show results of stats count when result is 0

tromero3 — Fri, 21 Aug 2020 21:01:26 GMT

Im confused about the split part, is that just combining the name of each index into one? (where you put

("ABC","")

And why is that part needed?

My index names are actually longer of course and with dashes in the name such as "first-index", "second-index', etc

Also the first part of my search is longer not just the individual index. But more like

(index=first-index event_type=security) OR (index=second-index rule_reason=IPblock)

and so on...

Re: Show results of stats count when result is 0

to4kawa — Fri, 21 Aug 2020 21:06:54 GMT

You asked what to do if you don't have index ABC, so I answered, but the conditions are totally different.

I can't answer this. Good luck.

Re: Show results of stats count when result is 0

ITWhisperer — Sat, 22 Aug 2020 10:28:05 GMT

Have you considered appending a dummy event for each log and then subtracting 1 from every count?

Re: Show results of stats count when result is 0

yeahnah — Sun, 23 Aug 2020 06:53:07 GMT

Hi @tromero3

You can hard code the log source list to the end of your results. Using your initial example query something like this should work.

Hope this helps.

Re: Show results of stats count when result is 0

tromero3 — Mon, 24 Aug 2020 20:08:44 GMT

wow that worked perfectly, thank you! 😀