topic Re: Need to display count having zero events in Splunk Search

Need to display count having zero events

prajwal_94 — Mon, 30 Aug 2021 10:20:52 GMT

I am having below search string and suppose the file "magic_new.log" has no events and the requirement is to show that as output

index=magic source IN ("D:\\show\\magic.log", "D:\\show\\magic_new.log", "D:\\show\\magic_old.log")
| stats count by source
| where count=0

current output-
no results found

expected output-
source count
D:\show\magic_new.log 0

(Note: Tried multiple solutions suggested in the community but none worked)

Re: Need to display count having zero events

PickleRick — Mon, 30 Aug 2021 10:40:59 GMT

Well, that's understandable firstly you select events using a set of constraints (in this case, possible index names), then you do a statistical operation on this set of events. Splunk in the | stats step doesn't know the original conditions. It only knows the events that have been supplied from the search.

If the filenames are known beforehand, you might prepare a static table using a lookup or an inline search with count=0 and then sum your results with those prepared earlier.

something like:

index=magic source IN ("D:\\show\\magic.log", "D:\\show\\magic_new.log", "D:\\show\\magic_old.log")
| stats count by source | append [ | makeresults 
| eval _raw="D:\\show\\magic.log
D:\\show\\magic_new.log
D:\\show\\magic_old.log" 
| multikv noheader=t 
| rename Column_1 as source 
| table source
| eval count=0 ] | stats sum(count) by source

Ugly as hell but should do.

If you have the filenames in a lookup you could just use inputlookup instead of all this consturction within [] (and use the lookup to generate constraints for the search as well- that way you have your search consistent.

Re: Need to display count having zero events

prajwal_94 — Mon, 30 Aug 2021 11:15:58 GMT

@PickleRick Thanks!....but when I tried for similar kind of source with name as- "D:\\show\\*.log" where * is dd-mm-yyyy it gives multiple entries of output as-

source sum(count)
D:\\show\\*.log 0
D:\\show\\30-08-2021.log 0

whereas required one is only-
D:\\show\\30-08-2021.log 0

do I need to make any changes in eval _raw, that you mentioned

Re: Need to display count having zero events

PickleRick — Mon, 30 Aug 2021 11:52:18 GMT

It won't work with glob patterns. It can't. Remember - as I wrote before - if you have your events as an output of the search (and want to do some further analysis like | stat) splunk doesn't know anymore what were the criteria you were searching by. So my walkaround was not letting you match filenames from "the input". It was just predicting the output.
You probably could do some magic to match with glob patterns or any other kind of match but that would involve either some kind of more complicated lookup matching or using some fancy evals.