Dashboards & Visualizations

I want to display the results as zero when there is no events in a timerange for filtered fields in search

sathiyasun
Explorer

I have put few IP's in the filter and have created filed for those IP's but when they die in the statistics not returning as zero rather its showing nothing, its showing only the IP's that has count. Please advise. Please find the below search and attached screenshot.

It shows only the filed has value. Not showing as zero event count the fields does not have events.

index=blu cs_host="collector*.abc.com" c_ip=10.xx.xx.233 OR c_ip=10.xx.xx.234 OR c_ip=10.xx.xx.248 OR c_ip=10.xx.xx.250 OR c_ip=10.xx.xx.42 OR c_ip=10.xx.xx.43
|stats count by c_ip|fillnull

0 Karma

renjith_nair
Legend

@sathiyasun ,

Try adding this to your search

|appendpipe [|stats count|where count=0]

ie.

index=blu cs_host="collector*.abc.com" c_ip=10.xx.xx.233 OR c_ip=10.xx.xx.234 OR c_ip=10.xx.xx.248 OR c_ip=10.xx.xx.250 OR c_ip=10.xx.xx.42 OR c_ip=10.xx.xx.43
|stats count by c_ip|appendpipe [|stats count|where count=0]
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

sathiyasun
Explorer

Please find the attached screenshot,

*.43 & *.248 does not have data in a timerange but in statistics not returning as zero count.since after the appendpipe and where condition. Please advise.

0 Karma

renjith_nair
Legend

Appendcols solution will work only if you dont have any events and show results as 0. If you want to show the IPs which does not have any events, then probably you should add a static list of IPs which you want to see using lookup or directly in the search and compare it against the events.

something similar to https://answers.splunk.com/answers/694862/using-a-lookup-table-how-do-you-compare-a-list-to.html

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...