topic Return 0 when "no results found" in Splunk Search

Return 0 when "no results found"

moizmmz — Wed, 08 May 2019 17:22:17 GMT

Hello,

In the following query, I'm hoping to return the value 0 to my dashboard panel if no results are found by the search query.

index=test "slice_played" externalUserID="$ext$" assetID!="806d682119ac46d18b9f4a5f3dc20b10" assetID!="5c117f3141244a3a9d6899395b5c65aa" $ass$ | stats sum(duration) as "y_seconds"

Please help! I've tried using the solution asked in a similar question, but to no avail.

Re: Return 0 when "no results found"

koshyk — Wed, 08 May 2019 18:35:13 GMT

Please try

<your search>..
| fillnull value=0 duration 
| stats sum(duration)  as "y_seconds"

Re: Return 0 when "no results found"

moizmmz — Wed, 08 May 2019 18:41:44 GMT

Tried this. Doesn't Work 😞

Re: Return 0 when "no results found"

koshyk — Wed, 08 May 2019 20:06:39 GMT

please provide some sample data and final output how you want to look like and we could write it for u

Re: Return 0 when "no results found"

moizmmz — Wed, 08 May 2019 20:14:24 GMT

Thats the thing though. For now, it returns "No results found". So instead of seeing "No results found" in my dashboard panel, I want to see 0 !!

Re: Return 0 when "no results found"

Vijeta — Wed, 08 May 2019 20:17:50 GMT

@moizmmz- Try below

index=test "slice_played" externalUserID="$ext$" assetID!="806d682119ac46d18b9f4a5f3dc20b10" assetID!="5c117f3141244a3a9d6899395b5c65aa" $ass$ | append [|makeresults| eval duration=0]|stats sum(duration) as "y_seconds"

Re: Return 0 when "no results found"

MuS — Wed, 08 May 2019 20:24:34 GMT

Hi moizmmz,

need to trick Splunk for this, because if there are no events Splunk will show No results found. So you need to add fake events and do some logic around. Try this run everywhere search:

index=_internal sourcetype!=splunkd_* baz
| append 
    [| makeresults 
    | stats count(foo) AS count 
    | eval _raw="Nothing to see here, move along!"] 
| streamstats count AS line_num 
| eval head_num=if((line_num > 1),(line_num - 1),1) 
| where (true() XOR ((count == 0) AND (head_num < line_num))) 
| fields - column, count, head_num, line_num 
| sort -_time | table *

The benefit of this search is that if there are no events it will only show one column with the message 😉

Hope this helps to get you started ...

cheers, MuS

PS: another example can be found here https://answers.splunk.com/answers/704513/how-do-i-show-0-when-no-results-are-found-in-a-rep.html

Re: Return 0 when "no results found"

koshyk — Wed, 08 May 2019 21:58:43 GMT

strange. what i've done is, if the value is empty, put the value to 0. So it will sum up 0 and should show 0. But anyways

Re: Return 0 when "no results found"

moizmmz — Wed, 08 May 2019 22:14:33 GMT

Yeah!!! that's exactly what I thought!

Re: Return 0 when "no results found"

moizmmz — Wed, 08 May 2019 22:14:44 GMT

Thanks though 🙂

Re: Return 0 when "no results found"

woodcock — Thu, 09 May 2019 01:25:07 GMT

Add this to the bottom of your search SPL string:

| appendpipe [stats count | where count=0]

You can thank @martin_mueller for this!