topic Re: Zero count not displaying when stats count is used in Splunk Search

Zero count not displaying when stats count is used

Harshi1993 — Thu, 02 Sep 2021 06:32:27 GMT

My query is :

I am getting the result as:

type Results

Success Accounts 10

Granting failed Accounts 20

I am unable to get the results for the string Inbound failed Accounts as the results are zero. I need the output as

type Results

Success Accounts 10

Granting failed Accounts 20

Inbound failed Accounts 0

Please help me with the query for displaying the strings with zero count as well

Re: Zero count not displaying when stats count is used

ITWhisperer — Thu, 02 Sep 2021 07:36:16 GMT

Re: Zero count not displaying when stats count is used

PickleRick — Thu, 02 Sep 2021 07:44:44 GMT

It's a typical mistake to want to have knowledge about _what_ was done earlier "down the road" whereas Splunk doesn't work that way.

After a pipe you get only a _result_ of the command from before the pipe. So if any command is supposed to look for - let's say - one of three different values but finds only two of them, the result will only have two of those values and any subsequent command won't have the knowledge that you wanted to search for the third value as well. You only get the results.

So the most obvious workaround in such case as yours is - as @ITWhisperer showed - creating an initial set of "empty" (with a value of zero) result set and then sum this set with your actual result. That way if you don't have any other results, you'll just stay with your static results of zero hits.

Re: Zero count not displaying when stats count is used

renjith_nair — Thu, 02 Sep 2021 07:44:27 GMT

Try

index="stage*" source="*record service*" | eval type=case(like(message, "%successful generated account%"),"Success Accounts", like(message, "%Granting failed Accounts%"),"Granting failed Accounts", like(message, "%Inbound setup failed accounts%"),"Inbound failed Accounts") |stats count as Results by type |append [|stats count as Results|eval type="Success Accounts,Granting failed Accounts,Inbound failed Accounts"|makemv type delim=","|mvexpand type] |stats sum(Results) by type