topic Re: How to display zero for latest(values) in Splunk Search

How to display zero for latest(values)

varsh_6_8_6 — Thu, 23 Jan 2025 16:33:37 GMT

The following is my query.

index="xyz" host="*"
|fields host,messagevalue
| search "total payment count :"
|eval messagevalue=mvindex(split(messagevalue,":"),1)
|stats latest(messagevalue)

For a given period if there are no events, No results found is displayed. Instead I want zeo to be displayed.

I tried using fillnull but no luck.

Re: How to display zero for latest(values)

gcusello — Thu, 23 Jan 2025 16:40:16 GMT

Hi @varsh_6_8_6 ,

you can find many anwers to this question and I proposed it in Splunk ideas to have this feature in fashboards and it's a future prospect, if you think that's interesting, upvote for it at https://ideas.splunk.com/ideas/EID-I-572

Anyway, in the meantime, only one question before the answer: is messageValue a number or what else?

if it's a number, please try:

Ciao.

Giuseppe

Re: How to display zero for latest(values)

ITWhisperer — Thu, 23 Jan 2025 21:09:36 GMT

| appendpipe [| stats count | where count==0]

Re: How to display zero for latest(values)

varsh_6_8_6 — Fri, 24 Jan 2025 11:30:09 GMT

Hi @gcusello
Thank you for the inputs. I have voted for the idea which is essential.
Also I have both number and string.
The one mentioned worked perfectly for the number.
Is there any way to display "No files found" in case there no latest events in a particular time.
Regards,
Varsh

Re: How to display zero for latest(values)

gcusello — Fri, 24 Jan 2025 13:43:27 GMT

Hi @varsh_6_8_6 ,

in this case, please try

Ciao.

Giuseppe