topic Splunk display a value when no logs are found in Splunk Search

Splunk display a value when no logs are found

Dayalss — Sun, 30 Apr 2023 12:35:50 GMT

Hi ,

I have a field which has 3 values i.e., 0 , 1 & 2.

0 for Green , 1 for Blue and 2 for Red. I'm using this values to show colour differences in dashboard.

But the search fetches data only at a particular time in a day , so the remaining time there is no data.

When there is no data , the dashboard is not loading.

I want to indicate no data with black colour in the dashboard.

How can I do that? where in if there is no day I can create and map a field value in dashboard

richgalloway — Sun, 30 Apr 2023 14:31:08 GMT

Use the appendpipe command to add values when none are returned by your query.

<<your search>> | appendpipe [ stats count | eval colour="black" | where count = 0 | fields - count]

Dayalss — Sun, 30 Apr 2023 15:02:15 GMT

Its not working , because I'm tracking the field Status for colour change using below query

index = xyz sourcetype =abc
|eval Status =if(Statistic=0,"Green" , if(Statistic=2 ,"Red",if(Statistic=1,"Blue", " " )))
|stats latest(Status)

Can you please suggest according to above query?

richgalloway — Sun, 30 Apr 2023 16:42:13 GMT

I suspect you were too literal in applying my answer. Try this