Report with all records with default value as 0

[runiyal]

I have captured different errors and made eventypes.
I am creating a creport based on these eventypes -

eventtype="Error1" OR "Error2" OR "Error3" | stats count as Total by eventtype|rename eventtype AS "Error Type" | sort - "Total"

Result I am getting is - If there is an error then it will show otherwise it will not. So, it might be 3 rows, or just 1 row returned or none.

Now I want to see the report for all the Errors irrespective of is it generated any error. If there is not error received in that timeframe, then it should show "0".

Will appreciate your inputs!

[lguinn2]

There is no way for Splunk to know all the possible sets of errors. However, you could supply a lookup table that contains the list. Assume that you have loaded a CSV into a lookup called error_list

error_category,eventtype
"Failed connection",failedConnection
"Bad user id",Error1
etc.

Now you can do this:

eventtype="Error1" OR "Error2" OR "Error3"
| stats count by eventtype
| append [ inputlookup error_list  | eval count = 0 ]
| stats sum(count) as Total by error_category
|rename error_category AS "Error Type" 
| sort - "Total"

The "error_category" field in the lookup is not really necessary, but it allows you to give a "nice name" for the error, and even to group eventtypes if you like.