topic 0 counts in Splunk Search

0 counts

av3rag3 — Tue, 17 Jun 2025 06:54:15 GMT

Hello,

with this query :

index=abc
| search source = "xyz"
| stats count by source

I can see the count of sources having count more than 0.
But I cant manage to get the ones with 0 count.
Anyone able to help me please ?

Thank you

Re: 0 counts

gcusello — Tue, 17 Jun 2025 07:06:49 GMT

Hi @av3rag3 ,

at first, don't use the search command after the main search because you'll have slower searches: put all the search terms as left as possible, possibly in the main search.

Then, why do you use the source as BY clausein stats command, if you always have only one source?

In general, without the condition source="xyz", it's normal that you haven't the results of source=0 because you don't have them from the search.

If you have a list of the sources to monitor, you could insert them in a lookup and add them to the search with count=0, something like this:

Ciao.

Giuseppe

Re: 0 counts

bowesmana — Tue, 17 Jun 2025 07:37:18 GMT

I would suggest a slightly optimal version that does not use the subsearch

index=abc | stats count by source | inputlookup append=t my_source_lookup.csv | fillnull count | stats sum(count) AS total BY source

Re: 0 counts

antoniolamonica — Fri, 27 Jun 2025 13:45:50 GMT

To concur with the above answers, you would have to utilize a lookup file that lists out all of the sources you want to monitor.

Natively, Splunk does not have a source = 0 events. (it doesn't know what it doesn't know).

In the environment we work in, we apply a siar approach but its based on host and whether the sources are coming in or not for our customers.

| tstats values(source) as source, values(sourcetype) as sourcetype WHERE index=[index] [ | inputlookup [myHostLookup].csv | fields host ] by host | stats count, values(sourcetype) as sourcetype, values(source) as source by host | eval Reporting=if(isnull(source), "No Matching Sources", "Yes") | table host, Reporting, source, sourcetype

---
If this reply helps you, Karma would be appreciated.