Dashboards & Visualizations

Need to show a zero on a multi stats graph

bigjoe1
New Member

Hi all,

Im tracking three set of stats on one graph two error counts and one success count. However my team has just fixed the issue behind "Error with Initiate Payment" and my graph is now no longer showing the other results.

Is there a way to show the null results as a zero as i would like to monitor this still moving forward.

Below is my query sorry best i can do 🙂 any help will be greatly received.

index=* host=* sourcetype=* "Error with Initiate Payment" | convert timeformat="%Y-%m-%d" ctime(_time) AS Date | stats count AS "Initiate Payment Failures" by Date | join [search index=* host=* sourcetype=* "Error with Submit Payment" | convert timeformat="%Y-%m-%d" ctime(_time) AS Date | stats count as "Submit Payment Failures" by Date] | join [search index=* host=** sourcetype=** "Submit Payment Response {"result":true,"serviceResponse":{"statusCode":200}}" | convert timeformat="%Y-%m-%d" ctime(_time) AS Date | stats count as "Payment Success" by Date]

Tags (2)
0 Karma

marycordova
SplunkTrust
SplunkTrust

Use a "fillnull", assuming these log events are generated even when there is no error.

index= host= sourcetype= "Error with Initiate Payment" | fillnull value="0"

If there literally are no log events generated you could artificially insert a "0" at the end of the search if there are no results:

| stats count as "Payment Success" by Date | eval count=if(isnull('count'),"0",'count')

@marycordova
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...