https://community.splunk.com/t5/Splunk-Search/How-to-search-all-events-and-corresponding-volume-but-display/m-p/222145#M65311 <P>Indeed, my answer was not complete. Refere to the other answer and follow the three steps after the base search and you should get it working.</P> Mon, 20 Jun 2016 07:07:29 GMT MuS 2016-06-20T07:07:29Z https://community.splunk.com/t5/Splunk-Search/How-to-search-all-events-and-corresponding-volume-but-display/m-p/222142#M65308 <P>I'm search to fetch the volume against different events in a given time frame. The problem I'm running into is that if one or more of those events that did not process any records during that time frame, they do not show up in the output. What search should I use to display volume as 0 with those missing events? Missing events should display with volume as 0 in the search output. Any help will be appreciated ..</P> Sun, 19 Jun 2016 19:01:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-all-events-and-corresponding-volume-but-display/m-p/222142#M65308 nasamajh09 2016-06-19T19:01:56Z https://community.splunk.com/t5/Splunk-Search/How-to-search-all-events-and-corresponding-volume-but-display/m-p/222143#M65309 <P>Hi nasamajh09,</P> <P>take a look at this answer <A href="https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html">https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html</A> which show a way how to do it.<BR /> In your case you could do something like this:</P> <PRE><CODE>your base search here to get all events | eval volume=if(isnotnull(volume), volume, "0") | do more stuff here </CODE></PRE> <P>This will search in your events for the field <CODE>volume</CODE> and if it is not null it will uses the value of <CODE>volume</CODE> otherwise it will be set to <CODE>0</CODE>.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Sun, 19 Jun 2016 20:50:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-all-events-and-corresponding-volume-but-display/m-p/222143#M65309 MuS 2016-06-19T20:50:12Z https://community.splunk.com/t5/Splunk-Search/How-to-search-all-events-and-corresponding-volume-but-display/m-p/222144#M65310 <P>Thank You MuS for your answer but it won't work because if there is no logs for any event ,event name will not appear while searching ,so no point of using isnotnull.</P> Mon, 20 Jun 2016 03:26:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-all-events-and-corresponding-volume-but-display/m-p/222144#M65310 nasamajh09 2016-06-20T03:26:18Z https://community.splunk.com/t5/Splunk-Search/How-to-search-all-events-and-corresponding-volume-but-display/m-p/222145#M65311 <P>Indeed, my answer was not complete. Refere to the other answer and follow the three steps after the base search and you should get it working.</P> Mon, 20 Jun 2016 07:07:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-all-events-and-corresponding-volume-but-display/m-p/222145#M65311 MuS 2016-06-20T07:07:29Z