topic Re: Search to show zero when no results in Splunk Search

Search to show zero when no results

matthewcanty — Wed, 19 Jun 2013 10:43:49 GMT

I have the following search:

earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | timechart span=30m count

At the moment there are no results. And I get the "No results..." message.
But I want to see a 0 for every 30-minute timespan between 1100 and 2200.
How do I do this?

If there was a single result I get the full table- but if there were results then an alert would not trigger.

Thanks,
Matt

Re: Search to show zero when no results

MuS — Wed, 19 Jun 2013 13:02:51 GMT

Hi matthewcanty

you can use fillnull on your search and you will get 0 for every empty field

... | fillnull

cheers, MuS

Re: Search to show zero when no results

sdaniels — Wed, 19 Jun 2013 13:04:12 GMT

MuS you beat me to it.

Re: Search to show zero when no results

MuS — Wed, 19 Jun 2013 13:16:56 GMT

out luck /K was not around, he would have answered this loooong before us 🙂

Re: Search to show zero when no results

matthewcanty — Wed, 19 Jun 2013 13:31:03 GMT

Doesn't work anyway guys.

Re: Search to show zero when no results

MuS — Wed, 19 Jun 2013 15:37:13 GMT

Hmm it looks like this only works, if your search returns at least one event....

Re: Search to show zero when no results

the_wolverine — Thu, 13 Feb 2014 18:29:57 GMT

http://answers.splunk.com/answers/118496/fill-in-0-for-timechart-with-missing-values

Re: Search to show zero when no results

splunk_kk — Fri, 16 Jun 2017 02:54:20 GMT

Try this:

Re: Search to show zero when no results

harry2007gsp — Mon, 17 Jun 2019 15:30:43 GMT

Yes, same thing is happening on my side. Fillnull is made for returning value for null attributes but the condition is to have at least a row of results. When there are no results at all, there is no fillnull working in that condition.

Re: Search to show zero when no results

MuS — Tue, 18 Jun 2019 19:05:22 GMT

Greetings from the future,

you can run a search like this:

index=_internal 
| stats count by sourcetype 
| append 
    [| stats count 
    | eval sourcetype=if(isnull(sourcetype), "Nothing to see here, move along!", sourcetype)] 
| streamstats count AS line_num 
| eval head_num=if(line_num > 1, line_num - 1, 1) | where NOT ( count=0 AND head_num < line_num ) | table sourcetype count

cheers, MuS