Splunk Search

Change the ''Waiting for data... '' message with a value or word

andrei1bc
Communicator

My search :

  index=test
  | where Value>=95
  | stats count(Value) as Events by Host

The result :

  • if there are values above 95 a table will be created by Host and number of Events per host
  • if there are no values above 95 i would like to return just a message "test" or an Event field as 0
Tags (1)
0 Karma
1 Solution

vasildavid
Path Finder

Try replacing the 'where' with an eval in your stats command:

index=test
| stats count(eval(Value>=95)) AS Events by Host

That should result in either a count of your events that have the field Value >= 95 or 0 if no events meet that criteria.

View solution in original post

0 Karma

jeffland
SplunkTrust
SplunkTrust

Generally, try to limit the data you search over as early as possible. In your case, instead of

index=test | where Value>=95

you do

index=test Value>=95

This will speed up your searches a lot, because splunk has to fetch a lot less events from disk.

0 Karma

vasildavid
Path Finder

Try replacing the 'where' with an eval in your stats command:

index=test
| stats count(eval(Value>=95)) AS Events by Host

That should result in either a count of your events that have the field Value >= 95 or 0 if no events meet that criteria.

0 Karma

andrei1bc
Communicator

The result for me is a table with multiple hosts and a 0 under Events. Can this be refined to just return a general 0 or message if there are no values above 95 (instead of multiple lines, just 1) ?

0 Karma

andrei1bc
Communicator

haha .. never mind ... just remove the Host at the end ...

  index=test
  | stats count(eval(Value>=95)) AS Events
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...