topic Re: Force the display of a value when the search is empty in Splunk Search

How to force the display of a value when the search is empty?

Rajaion — Mon, 29 Aug 2022 13:40:05 GMT

Hello community,

I have a problem with a search that does not return a result. For the purposes of a dashboard, I need one of my searches, when it does not return a result, to display 0.
I have already succeeded in this modification in some somewhat complex searches but for a fairly simple search, I cannot do it. Here is the example in question:

Note that when I have a result, it is displayed well, my search runs correctly.

I attempted to use the command "| eval ACKED = if(isnull(ACKED) OR len(ACKED)==0, "0", ACKED)" but search doesn't seem to read it:

I found several topics on similar subjects (with the use of fillnull for example) but without result :

I think it's not complicated but I can't put my finger on what's the problem, do you have any idea?

Best regards,

Rajaion

Re: Force the display of a value when the search is empty

gcusello — Mon, 29 Aug 2022 10:38:38 GMT

Hi @Rajaion,

after the last stats and the final table commands, add the following rows:

I asked to Splunk Ideas to add this feature to panels and it is in evaluation for a future prospect, if you think that it's a good idea, vote for it at https://ideas.splunk.com/ideas/EID-I-572 .

Ciao.

Giuseppe

Re: Force the display of a value when the search is empty

Rajaion — Mon, 29 Aug 2022 14:56:29 GMT

Hi @gcusello ,

This is exactly what I was looking for, I hadn't thought of this function (which I will dig into to better understand how it works).

Thank you very much for your help, my dashboards are perfect now!

I voted for your idea, indeed, a simple button for this kind of thing should exist.

Best regards,

Rajaion