Splunk Search

Change the ''Waiting for data... '' message with a value or word

andrei1bc
Communicator

My search :

  index=test
  | where Value>=95
  | stats count(Value) as Events by Host

The result :

  • if there are values above 95 a table will be created by Host and number of Events per host
  • if there are no values above 95 i would like to return just a message "test" or an Event field as 0
Tags (1)
0 Karma
1 Solution

vasildavid
Path Finder

Try replacing the 'where' with an eval in your stats command:

index=test
| stats count(eval(Value>=95)) AS Events by Host

That should result in either a count of your events that have the field Value >= 95 or 0 if no events meet that criteria.

View solution in original post

0 Karma

jeffland
SplunkTrust
SplunkTrust

Generally, try to limit the data you search over as early as possible. In your case, instead of

index=test | where Value>=95

you do

index=test Value>=95

This will speed up your searches a lot, because splunk has to fetch a lot less events from disk.

0 Karma

vasildavid
Path Finder

Try replacing the 'where' with an eval in your stats command:

index=test
| stats count(eval(Value>=95)) AS Events by Host

That should result in either a count of your events that have the field Value >= 95 or 0 if no events meet that criteria.

0 Karma

andrei1bc
Communicator

The result for me is a table with multiple hosts and a 0 under Events. Can this be refined to just return a general 0 or message if there are no values above 95 (instead of multiple lines, just 1) ?

0 Karma

andrei1bc
Communicator

haha .. never mind ... just remove the Host at the end ...

  index=test
  | stats count(eval(Value>=95)) AS Events
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...