Getting Data In

How to display fields in a table panel even if the result field = 0?

jip31
Motivator

hello

In a panel table, I need to display every sourcetype results even if the sourcetype result = 0
I have done an if condition but it doenst works
could you help me please?

`windows` sourcetype="Win" OR sourcetype=report OR sourcetype=abdm OR sourcetype=app OR sourcetype="flags" OR sourcetype="up" 
| stats dc(host) as "Number of hosts" by sourcetype 
| sort -"Number of hosts"
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jip31

Can you please try this?

 `windows` sourcetype="Win" OR sourcetype=report OR sourcetype=abdm OR sourcetype=app OR sourcetype="flags" OR sourcetype="up" 
| stats dc(host) as count by sourcetype 
| sort -"Number of hosts" | append [| makeresults 
| eval sourcetype="Win||report||abdm||app||flags||up",sourcetype=split(sourcetype,"||"), count=0
| mvexpand sourcetype 
| table sourcetype count ]  | stats sum(count) as "Number of hosts" by sourcetype

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jip31

Can you please try this?

 `windows` sourcetype="Win" OR sourcetype=report OR sourcetype=abdm OR sourcetype=app OR sourcetype="flags" OR sourcetype="up" 
| stats dc(host) as count by sourcetype 
| sort -"Number of hosts" | append [| makeresults 
| eval sourcetype="Win||report||abdm||app||flags||up",sourcetype=split(sourcetype,"||"), count=0
| mvexpand sourcetype 
| table sourcetype count ]  | stats sum(count) as "Number of hosts" by sourcetype
0 Karma

jip31
Motivator

many thanks!!

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...