https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-create-a-summary-index-with-a-count-of/m-p/274360#M82760 <P>Thanks but that didn't do it. I don't get data when I have no events.</P> Thu, 27 Oct 2016 05:59:12 GMT burwell 2016-10-27T05:59:12Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-create-a-summary-index-with-a-count-of/m-p/274358#M82758 <P>I have a search to create a summary index which runs every 15 minutes:</P> <PRE><CODE> index=foo "myerror" | bin span=15m _time | sistats count by _time </CODE></PRE> <P>I'd like to have 0 in my summary search when there are no events matching "myerror".</P> <P>How do I do that?</P> Thu, 27 Oct 2016 02:06:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-create-a-summary-index-with-a-count-of/m-p/274358#M82758 burwell 2016-10-27T02:06:20Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-create-a-summary-index-with-a-count-of/m-p/274359#M82759 <P>See if this works: Change it from sistats to stats and use the collect command..,</P> <PRE><CODE> ... | stats count by _time | collect index=summary </CODE></PRE> Thu, 27 Oct 2016 02:38:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-create-a-summary-index-with-a-count-of/m-p/274359#M82759 jkat54 2016-10-27T02:38:24Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-create-a-summary-index-with-a-count-of/m-p/274360#M82760 <P>Thanks but that didn't do it. I don't get data when I have no events.</P> Thu, 27 Oct 2016 05:59:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-create-a-summary-index-with-a-count-of/m-p/274360#M82760 burwell 2016-10-27T05:59:12Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-create-a-summary-index-with-a-count-of/m-p/274361#M82761 <P>Give this a try</P> <PRE><CODE> index=foo "myerror" | bin span=15m _time | sistats count by _time | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time| bucket span=15m _time | table _time count | sistats count by _time ] </CODE></PRE> Thu, 27 Oct 2016 16:16:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-create-a-summary-index-with-a-count-of/m-p/274361#M82761 somesoni2 2016-10-27T16:16:09Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-create-a-summary-index-with-a-count-of/m-p/274362#M82762 <P>I tried this (I am getting rid of the bin span)... this works except when there are no errors then it says 1 instead of 0.</P> <P>I tried adding eval count=count-1 in the appendpipe clause but could not get this to give me zero.</P> <PRE><CODE>index=foo "myerror" | sistats count |appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time| table _time count | sistats count ] </CODE></PRE> Sun, 30 Oct 2016 02:33:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-create-a-summary-index-with-a-count-of/m-p/274362#M82762 burwell 2016-10-30T02:33:09Z