Display Field Even No Values

[qygoh]

Hi i encounter an issues when i try to display field in table form without any values my data look like table below:

ID Values
MAIN1 1.5
MAIN2

MAIN3

MAIN4 4.3

This is my search string:

Label="MIDPM"  Order=2 |stats latest(Value) as Value by ID| eval Value=round(Value,2)| eval Value=if(isnull(VALUE),0,Value)| rename ID as Label

The result i get was display Main1 and Main4 only. I fail to replace those fields as zero. Mind to how should i resolve this issues?

[woodcock]

Try adding this:

 ... | eval Value=if(isnum(Value),Value,0)

[qygoh]

I just tried it out it only show me the result with MAIN1 AND MAIN4

[woodcock]

You need to decide what the name of your "value" field is: is it VALUE, Value, or Values (you use each of this in different spots). Once you use the SAME NAME CONSISTENTLY, then this answer will work.

[qygoh]

is Value i tried this as well
if(isnull($result.MAIN2$),0.00,$result.MAIN2$)
it didn't working

[qygoh]

i not sure isn't possible due Splunk 6.4 didn't compatible with "fillnull" feature

[woodcock]

Add this:

... | fillnull value="0" Value

[qygoh]

it didn't work the value is no null or empty that why "fillnull" no working

[woodcock]

You need to decide what the name of your "value" field is: is it VALUE, Value, or Values (you use each of this in different spots). Once you use the SAME NAME CONSISTENTLY, then this answer will work.

[gcusello]

Hi qygoh,
have VALUE in uppercase is an error in your answer or is really uppercase?
because you should use

| eval Value=if(isnull(Value),0,Value)

Bye.
Giuseppe

[qygoh]

hi my value is in lower case. sorry for the typo. But it still no working due to no result found. It didn't show as null or empty.