Splunk Enterprise

Can I make tstats query return results day wise as zero?

Ash1
Path Finder

getting "no results found" ,but  i want the results day wise as zero

Query1:

|tstats count where index=applicationlogs sourcetype=app-logs by PREFIX(report:) _time
|rename report: as Report
|eval Flaw=if(Report!="0", "Flaw", null())
|where Report!=0
|timechart span=1d max(count)  as Flaw
|fillnull value=0 Flaw

Query2:

index=applicationlogs sourcetype=app-logs
|rex field= _raw "CCC\s\d+\:\d+\:\d+\,\d{3}\(\s+\)\s\-\s(?<status>.*)"
|where isnotnull(status)
|convert timeformat="%d-%m-%Y" ctime(_time) as date
|stats count by date




Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

As @ITWhisperer said check what your first tstats return. It could be something else what you are expecting. I suppose that you have already read (at least) these two presentations

Which covers tstats with TERM and PREFIX and what you must consider when you are using those.

r. Ismo 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try executing each of your searches with an increasing number of lines until you find the line that causes there to be no results.

0 Karma

Ash1
Path Finder

Hi @ITWhisperer 
What do u men by increasing number of lines??

For example if i wany to see 5 days data, if there is no data i want to see rows by showing count as zero.

Tags (1)
0 Karma

burwell
SplunkTrust
SplunkTrust

Hi what @ITWhisperer meant, I believe, is try the first line of your tstats by itself. If that works dd the second line etc.

 

What I do is to comment out the lines you don't want to run when three backs ticks. Then I have the query ready to uncomment.

ITWhisperer
SplunkTrust
SplunkTrust

Yes, as @burwell said, try the first command of the search to see if you get results, then the first two commands, etc. That way you can identify which line is causing you to get no results.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...