Splunk Enterprise

help to display 0 & unit if there is no results

jip31
Motivator

hi

if tere is no results retourned I need to display 0 in my single panel and the unit whic is "sec"

So I need to display "0 sec" and the formatting options even if there is no results

how to do this please?

<single>
        <title>Bur</title>
        <search base="hang">
          <query>| stats perc90(hang_duration_sec) as hang_duration_sec </query>
        </search>
        <option name="drilldown">none</option>
        <option name="height">85</option>
        <option name="numberPrecision">0.0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,5,10]</option>
        <option name="refresh.display">progressbar</option>
        <option name="unit">sec</option>
        <option name="useColors">1</option>
      </single>
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats perc90(hang_duration_sec) as hang_duration_sec
| appendpipe [stats count as _events | where _events = 0 | eval hang_duration_sec = 0 ]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats perc90(hang_duration_sec) as hang_duration_sec
| appendpipe [stats count as _events | where _events = 0 | eval hang_duration_sec = 0 ]
0 Karma

jip31
Motivator

thanks

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...