https://community.splunk.com/t5/Splunk-Search/Splunk-subsearch-noresult/m-p/119361#M32016 <P>Am trying to run a query where subsearch might return no results on some days. In such case i am trying to assign 0 values to calculate ratio, but its not returning any results.</P> <PRE><CODE>index=main sourcetype="abc" | eval date=strftime(_time, "%x") | stats dc(uuid) as countA by date | join _time [ search index=main sourcetype="abc" | eval date=strftime(_time, "%x") | search "error" | stats dc(uuid) as countB by date] | eval Ratio=(countA/(countA+countB)) </CODE></PRE> <P>I have tried appending fillnull at the end of subsearch but it returns noresults.</P> Mon, 20 Jan 2014 09:27:33 GMT pdash 2014-01-20T09:27:33Z https://community.splunk.com/t5/Splunk-Search/Splunk-subsearch-noresult/m-p/119361#M32016 <P>Am trying to run a query where subsearch might return no results on some days. In such case i am trying to assign 0 values to calculate ratio, but its not returning any results.</P> <PRE><CODE>index=main sourcetype="abc" | eval date=strftime(_time, "%x") | stats dc(uuid) as countA by date | join _time [ search index=main sourcetype="abc" | eval date=strftime(_time, "%x") | search "error" | stats dc(uuid) as countB by date] | eval Ratio=(countA/(countA+countB)) </CODE></PRE> <P>I have tried appending fillnull at the end of subsearch but it returns noresults.</P> Mon, 20 Jan 2014 09:27:33 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-subsearch-noresult/m-p/119361#M32016 pdash 2014-01-20T09:27:33Z https://community.splunk.com/t5/Splunk-Search/Splunk-subsearch-noresult/m-p/119362#M32017 <P>got it:</P> <P>index=main sourcetype="abc" <BR /> | eval date=strftime(_time, "%x") <BR /> | stats dc(uuid) as countA by date<BR /><BR /> | join _time [ search index=main sourcetype="abc" | eval date=strftime(_time, "%x") | search "error" | stats dc(uuid) as countB by date | appendpipe [ stats count | eval countB=0 | where count==0 | fields - count ] ]<BR /> | eval Ratio=(countA/(countA+countB))</P> Mon, 28 Sep 2020 15:41:11 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-subsearch-noresult/m-p/119362#M32017 pdash 2020-09-28T15:41:11Z