Splunk Enterprise

help to display 0 & unit if there is no results

jip31
Motivator

hi

if tere is no results retourned I need to display 0 in my single panel and the unit whic is "sec"

So I need to display "0 sec" and the formatting options even if there is no results

how to do this please?

<single>
        <title>Bur</title>
        <search base="hang">
          <query>| stats perc90(hang_duration_sec) as hang_duration_sec </query>
        </search>
        <option name="drilldown">none</option>
        <option name="height">85</option>
        <option name="numberPrecision">0.0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,5,10]</option>
        <option name="refresh.display">progressbar</option>
        <option name="unit">sec</option>
        <option name="useColors">1</option>
      </single>
Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats perc90(hang_duration_sec) as hang_duration_sec
| appendpipe [stats count as _events | where _events = 0 | eval hang_duration_sec = 0 ]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats perc90(hang_duration_sec) as hang_duration_sec
| appendpipe [stats count as _events | where _events = 0 | eval hang_duration_sec = 0 ]
0 Karma

jip31
Motivator

thanks

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...