Can I make tstats query return results day wise as zero?

[Ash1]

getting "no results found" ,but  i want the results day wise as zero

Query1:

|tstats count where index=applicationlogs sourcetype=app-logs by PREFIX(report:) _time
|rename report: as Report
|eval Flaw=if(Report!="0", "Flaw", null())
|where Report!=0
|timechart span=1d max(count)  as Flaw
|fillnull value=0 Flaw

Query2:

index=applicationlogs sourcetype=app-logs
|rex field= _raw "CCC\s\d+\:\d+\:\d+\,\d{3}\(\s+\)\s\-\s(?<status>.*)"
|where isnotnull(status)
|convert timeformat="%d-%m-%Y" ctime(_time) as date
|stats count by date

[isoutamo]

Hi

As @ITWhisperer said check what your first tstats return. It could be something else what you are expecting. I suppose that you have already read (at least) these two presentations

• https://conf.splunk.com/files/2020/slides/PLA1089C.pdf
• https://conf.splunk.com/files/2022/slides/PLA1466B.pdf

Which covers tstats with TERM and PREFIX and what you must consider when you are using those.

r. Ismo 

[ITWhisperer]

Try executing each of your searches with an increasing number of lines until you find the line that causes there to be no results.

[Ash1]

Hi @ITWhisperer 
What do u men by increasing number of lines??

For example if i wany to see 5 days data, if there is no data i want to see rows by showing count as zero.

[burwell]

Hi what @ITWhisperer meant, I believe, is try the first line of your tstats by itself. If that works dd the second line etc.

What I do is to comment out the lines you don't want to run when three backs ticks. Then I have the query ready to uncomment.

[ITWhisperer]

Yes, as @burwell said, try the first command of the search to see if you get results, then the first two commands, etc. That way you can identify which line is causing you to get no results.