topic Re: Show count 0 on tstats with index name for multiple indexes in Splunk Search

Show count 0 on tstats with index name for multiple indexes

mkarimi17 — Tue, 05 Sep 2017 16:18:22 GMT

I have a search:

| tstats count WHERE earliest=-2d@-3h latest=now index=* by index, _time | makecontinuous span=1h _time | eval count=if(isnull(count),0,count)

where the count is shown as 0 if there is no data, however I get an empty field for the index at that specific time. How can I search for every hour and every index and if index Y does not have any count to show:

index _time &nbsp count
Y 2017-09-03 00:00 0

Re: Show count 0 on tstats with index name for multiple indexes

somesoni2 — Tue, 05 Sep 2017 16:21:22 GMT

Give this a try

| tstats count WHERE earliest=-2d@-3h latest=now index=* by index, _time span=1h | timechart sum(count) as count by index limit=0 | fillnull value=0 | untable _time index count

Re: Show count 0 on tstats with index name for multiple indexes

mkarimi17 — Tue, 05 Sep 2017 16:34:03 GMT

thanks! that actually works but any idea why if I go back more than 4 days I lose the hour portion of the _time?

| tstats count WHERE earliest=-5d@-3h latest=now index=* by index, _time span=1h | timechart sum(count) as count by index limit=0 | fillnull value=0 | untable _time index count

when I do that, time only shows the dates. Realistically I am going back -30 days

Re: Show count 0 on tstats with index name for multiple indexes

somesoni2 — Tue, 05 Sep 2017 16:37:24 GMT

My bad. I didn't set the span in timechart command so it was doing auto span based on number of points (which will be higher with longer timerange), try this version

| tstats count WHERE earliest=-5d@-3h latest=now index=* by index, _time span=1h | timechart span=1h sum(count) as count by index limit=0 | fillnull value=0 | untable _time index count

Re: Show count 0 on tstats with index name for multiple indexes

mkarimi17 — Tue, 05 Sep 2017 17:05:43 GMT

Perfect! thank you