topic Re: How to display count as zero when no events are returned in Splunk Search

How to display count as zero when no events are returned

493600 — Wed, 22 May 2024 16:57:07 GMT

I have three lookup files and I am trying to find out which one has a zero count.

Below is the query I am using.

I want to know which threat_key has a zero count for threat_key=*risklist_hrly*. I have tried fillnull, its not working.

I can only see the one that has count. I want to get the one that has zero count.

Re: How to display count as zero when no events are returned

gcusello — Wed, 22 May 2024 13:34:08 GMT

Hi @493600,

please try this:

if in all lookups there's a field called "threat_key".

Ciao.

Giuseppe

Re: How to display count as zero when no events are returned

493600 — Thu, 23 May 2024 08:48:43 GMT

@gcusello

Thanks for your response but this doesn't work. Its making all the count 0 when we add | eval count=0

Re: How to display count as zero when no events are returned

ITWhisperer — Thu, 23 May 2024 09:24:25 GMT

if mask is 7 the key is in all files

if it is 6 it is in ip_intel and http_intel

if it is 5 it is in file_intel and http_intel

etc.

Re: How to display count as zero when no events are returned

493600 — Mon, 03 Jun 2024 09:35:00 GMT

Hello,

I have got the solution to this. We need to first create results and initialize the count as 0. it will create one table with 4 rows. Then join that with the other lookup files. Below is the query that I have used:

Re: How to display count as zero when no events are returned

gcusello — Mon, 03 Jun 2024 10:03:51 GMT

Hi @493600 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉