Splunk Enterprise

help to display 0 in single panel if no results

jip31
Motivator

hello

I need to display 0 in a single panel if there is no results

I tried the 2 solutions below but it doesnt works

how to do this please?

 

| stats avg(Response) 
| eval Response=if(Response="0","0",Response)
| stats avg(Response) 
| eval Response=if(Response="","0",Response)

 

Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

If you don't have any responses in your timerange you simply won't get any results, which is different than a result with a null value. So you can't "fix" the result because there isn't any.

There's a little trick which you can do though that will produce a result. Just do another stat that will always show. Like

<<your search>>
| stats avg(Response) as ar count(Response) as cr
| eval ar=if(cr=0,0,ar)
| fields - cr

This way you'll always get a count value even if it's just a zero.

Then you can either do a conditional on returned number (as shown above) or - alternatively - do a conditional on avg being null.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If you don't have any responses in your timerange you simply won't get any results, which is different than a result with a null value. So you can't "fix" the result because there isn't any.

There's a little trick which you can do though that will produce a result. Just do another stat that will always show. Like

<<your search>>
| stats avg(Response) as ar count(Response) as cr
| eval ar=if(cr=0,0,ar)
| fields - cr

This way you'll always get a count value even if it's just a zero.

Then you can either do a conditional on returned number (as shown above) or - alternatively - do a conditional on avg being null.

0 Karma

jip31
Motivator

thanks

0 Karma

ashvinpandey
Contributor

@PickleRick i think there is a correction in your eval:

| eval ar=if(cr=1,0,ar)

Also, If this reply helps you, an upvote would be appreciated.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

No. If count equals 0, it means that there were no entries to be counted, so there is no avg calculated and we have to replace the null value with something reasonable.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...