Splunk Enterprise

help to display 0 in single panel if no results

jip31
Motivator

hello

I need to display 0 in a single panel if there is no results

I tried the 2 solutions below but it doesnt works

how to do this please?

 

| stats avg(Response) 
| eval Response=if(Response="0","0",Response)
| stats avg(Response) 
| eval Response=if(Response="","0",Response)

 

Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

If you don't have any responses in your timerange you simply won't get any results, which is different than a result with a null value. So you can't "fix" the result because there isn't any.

There's a little trick which you can do though that will produce a result. Just do another stat that will always show. Like

<<your search>>
| stats avg(Response) as ar count(Response) as cr
| eval ar=if(cr=0,0,ar)
| fields - cr

This way you'll always get a count value even if it's just a zero.

Then you can either do a conditional on returned number (as shown above) or - alternatively - do a conditional on avg being null.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If you don't have any responses in your timerange you simply won't get any results, which is different than a result with a null value. So you can't "fix" the result because there isn't any.

There's a little trick which you can do though that will produce a result. Just do another stat that will always show. Like

<<your search>>
| stats avg(Response) as ar count(Response) as cr
| eval ar=if(cr=0,0,ar)
| fields - cr

This way you'll always get a count value even if it's just a zero.

Then you can either do a conditional on returned number (as shown above) or - alternatively - do a conditional on avg being null.

0 Karma

jip31
Motivator

thanks

0 Karma

ashvinpandey
Contributor

@PickleRick i think there is a correction in your eval:

| eval ar=if(cr=1,0,ar)

Also, If this reply helps you, an upvote would be appreciated.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

No. If count equals 0, it means that there were no entries to be counted, so there is no avg calculated and we have to replace the null value with something reasonable.

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...