https://community.splunk.com/t5/Splunk-Search/user-with-no-activity/m-p/454283#M171252 <P>This works partially. I am getting the remote_users as a column in my table. However, the user, who does not have the activity is showing blank row instead 0. How can I force 0 when there is no activity?</P> Tue, 14 May 2019 18:28:31 GMT gnshah12345 2019-05-14T18:28:31Z https://community.splunk.com/t5/Splunk-Search/user-with-no-activity/m-p/454281#M171250 <P>We are monitoring the user activities for a day. The query is as follows.</P> <P>remote_user=a OR remote_user=b OR remote_user=c index=my_index earliest=@d+450m latest=@d+18h |timechart count as "User Name" by remote_user.</P> <P>The issue is if a user does not have activity than report is not showing that. We want the report to include the user with 0 activity. Is there a way to force that into search?</P> Wed, 30 Sep 2020 00:30:15 GMT https://community.splunk.com/t5/Splunk-Search/user-with-no-activity/m-p/454281#M171250 gnshah12345 2020-09-30T00:30:15Z https://community.splunk.com/t5/Splunk-Search/user-with-no-activity/m-p/454282#M171251 <P>try something like this:</P> <PRE><CODE>remote_user=a OR remote_user=b OR remote_user=c index=my_index earliest=@d+450m latest=@d+18h |timechart count as "User Name" by remote_user | table _time a b c | fillnull value=0 </CODE></PRE> <P>hope it helps</P> Tue, 14 May 2019 00:15:12 GMT https://community.splunk.com/t5/Splunk-Search/user-with-no-activity/m-p/454282#M171251 adonio 2019-05-14T00:15:12Z https://community.splunk.com/t5/Splunk-Search/user-with-no-activity/m-p/454283#M171252 <P>This works partially. I am getting the remote_users as a column in my table. However, the user, who does not have the activity is showing blank row instead 0. How can I force 0 when there is no activity?</P> Tue, 14 May 2019 18:28:31 GMT https://community.splunk.com/t5/Splunk-Search/user-with-no-activity/m-p/454283#M171252 gnshah12345 2019-05-14T18:28:31Z https://community.splunk.com/t5/Splunk-Search/user-with-no-activity/m-p/454284#M171253 <P>The result works partially. I am getting users as the column headers. However, the row is empty for user, who has no activity at all. The desirable result is to have 0 instead of blank.</P> Tue, 14 May 2019 18:30:12 GMT https://community.splunk.com/t5/Splunk-Search/user-with-no-activity/m-p/454284#M171253 gnshah12345 2019-05-14T18:30:12Z