Splunk Enterprise Security

Aggregate function ignore null values

Ropermark
New Member

Hello all,

I am new to splunk,

By following string i get a graph of risk:

index="iniatva_linux" Risk=Critical OR Risk=High OR Risk=Medium OR Risk=Low | where like(Name, "%Unsupported%") | chart count by Risk

But the problem is for Risk (high, medium and low) the value is zero that why i see even see the field in graph.
How i can see the field with zero value also in graph..

Thanks in advance

0 Karma

niketn
Legend

@Ropermark, before suggesting a solution to your issue, first you should move the where clause as search filter in your main query i.e. instead of adding | where like(Name, "%Unsupported%") you should use Name="*Unsupported*" wildcard filter in your base query.

Coming to your question if you want to bring in the series which have 0 count you can use append to add dummy rows for each Risk type with count as 0. Then use a dedup by Risk names to retain only one row per risk which will keep rows with count > 0 and missing rows with count as 0.

index="iniatva_linux" Risk=Critical OR Risk=High OR Risk=Medium OR Risk=Low Name="*Unsupported*"
| chart count by Risk
| append 
    [| makeresults
    | fields - _time
    | eval data="Risk=Critical,count=0;Risk=High,count=0;Risk=Medium,count=0;Risk=Low,count=0;"
    | makemv data delim=";"
    | mvexpand data
    | rename data as _raw
    | KV
    | table Risk count]
| dedup Risk

Following is a run anywhere search example based on Splunk's _internal index which use log_level INFO, WARN, ERROR and FATAL, similar to your request for Risk. Please try out and confirm!

index=_internal sourcetype=splunkd log_level!=INFO 
| chart count by log_level 
| append 
    [| makeresults
    | fields - _time
    | eval data="log_level=INFO,count=0;log_level=ERROR,count=0;log_level=WARN,count=0;log_level=FATAL,count=0;"
    | makemv data delim=";"
    | mvexpand data
    | rename data as _raw
    | KV
    | table log_level count]
| dedup log_level
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...