0 counts

[av3rag3]

Hello,

with this query :

index=abc
| search source = "xyz"
| stats count by source

I can see the count of sources having count more than 0. 
But I cant manage to get the ones with 0 count. 
Anyone able to help me please ? 

Thank you 

[antoniolamonica]

To concur with the above answers, you would have to utilize a lookup file that lists out all of the sources you want to monitor.

Natively, Splunk does not have a source = 0 events. (it doesn't know what it doesn't know).

In the environment we work in, we apply a siar approach but its based on host and whether the sources are coming in or not for our customers.

| tstats values(source) as source, values(sourcetype) as sourcetype
WHERE index=[index]

     [ | inputlookup [myHostLookup].csv
       | fields host ]

by host

| stats count, values(sourcetype) as sourcetype, values(source) as source
by host

| eval Reporting=if(isnull(source), "No Matching Sources", "Yes")
| table host, Reporting, source, sourcetype

---
If this reply helps you, Karma would be appreciated.

[gcusello]

Hi @av3rag3 ,

at first, don't use the search command after the main search because you'll have slower searches: put all the search terms as left as possible, possibly in the main search.

Then, why do you use the source as BY clausein stats command, if you always have only one source?

In general, without the condition source="xyz", it's normal that you haven't the results of source=0 because you don't have them from the search.

If you have a list of the sources to monitor, you could insert them in a lookup and add them to the search with count=0, something like this:

index=abc
| stats count by source
| append [ | inputlookup my_source_lookup.csv | eval count=0 | fields source count ]
| stats sum(count) AS total BY source

Ciao.

Giuseppe

[bowesmana]

I would suggest a slightly optimal version that does not use the subsearch

index=abc
| stats count by source
| inputlookup append=t my_source_lookup.csv 
| fillnull count
| stats sum(count) AS total BY source