topic Re: How to display 0 when there is No Records Found or Nothing returned in Splunk Search

How to display 0 when there is No Records Found or Nothing returned

splunkbeginner — Wed, 30 Sep 2020 05:06:01 GMT

the search (thanks for who provided this) is:

| tstats count where host=linux01 sourcetype="linux:audit" by _time span=1d prestats=t
| timechart span=1d count as total
| appendcols [ search host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls)
| timechart span=1d count as filter]

If there is no matched event to return for "total" and "filter", I get "Not Results Found". If there is no matched event return for "total" or "filter", I get nothing on the timechart for "total" or "filter"

I would instead like a 0 displayed. Any idea will be much appreciated.

Re: How to display 0 when there is No Records Found or Nothing returned

to4kawa — Sat, 18 Apr 2020 02:47:47 GMT

https://answers.splunk.com/answers/733553/how-do-i-append-a-specific-field-with-specific-val.html

Re: How to display 0 when there is No Records Found or Nothing returned

splunkbeginner — Wed, 30 Sep 2020 05:02:41 GMT

@to4kawa

Thanks for the link. Any idea how i can tune the appendage to yield correct events? Thanks

Re: How to display 0 when there is No Records Found or Nothing returned

to4kawa — Sat, 18 Apr 2020 05:23:00 GMT

....
| appendpipe [| stats count as total
| where total=0
| eval total=0]

Re: How to display 0 when there is No Records Found or Nothing returned

splunkbeginner — Mon, 20 Apr 2020 01:11:03 GMT

@to4kawa

thanks but still I get nothing on the timechart for "total" or "filter" when there is no matched event return for "total" or "filter",

Re: How to display 0 when there is No Records Found or Nothing returned

to4kawa — Mon, 20 Apr 2020 02:08:29 GMT

index=_internal "nothing counts"
| stats count as total by sourcetype
| appendpipe [ stats count as total
| where total=0
| eval total=0]

Re: How to display 0 when there is No Records Found or Nothing returned

splunkbeginner — Mon, 20 Apr 2020 03:41:53 GMT

@to4kawa

thanks again. maybe i don't know how to fit your suggestion to my search... but thanks anyway.

nevertheless i tried a query from another splunk answer and its working fine.
| appendpipe [ stats count | eval "NoResults"="0" | where count=0 |table "NoResults"]

Re: How to display 0 when there is No Records Found or Nothing returned

harishalipaka — Mon, 20 Apr 2020 06:38:57 GMT

@splunkbeginner

try like this

| tstats count where host=linux01 sourcetype="linux:audit" by _time span=1d prestats=t
| timechart span=1d count as total
| appendcols [ search host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls)
| timechart span=1d count as filter]
| stats count as total by sourcetype
 | appendpipe [ stats count as total
 | where total=0
 | eval total=0,filter=0]

Re: How to display 0 when there is No Records Found or Nothing returned

splunkbeginner — Tue, 21 Apr 2020 01:18:09 GMT

@harishalipaka

thanks but it somehow doesn't work for me.

nevertheless i tried a query from another splunk answer and its working fine.
| appendpipe [ stats count | eval "NoResults"="0" | where count=0 |table "NoResults"]