Display a custom text when results=0

[Richy_s]

How do I run a search against a sourcetype (which is very low volume), and display a custom text when there are 0 events found.  Search should be run for 30days, with a span of 1day.

Output should be -

_time results

04-23-2024 "No events found"

04-23-2024 "No events found"

.

.

.

06-30-2024 23

[Richy_s]

That worked!! One last thing, how do I display only specific sourcetype out of (A B C D E) for where the events for all the days=0. reword this statement

[ITWhisperer]

There are a number of ways to do this - to find which sourcetypes have zero events, create an event for each sourcetype with a zero count and add it to the count for the sourcetype, and where the count is still zero, there were no events for that sourcetype.

| stats count by sourcetype
| append
    [| makeresults format=csv data="sourcetype,count
A,0
B,0
C,0
D,0
E,0
F,0"
    | table sourcetype count]
| stats sum(count) as count by sourcetype
| where count=0
| eval count="No events found"

[Richy_s]

That worked, one last thing, how do I display only specific sourcetype out of (A B C D E) for where event for each day?

[ITWhisperer]

Not sure I understand the requirement - do you want to remove the sourcetypes which have events every day? Please clarify

[MuS]

Another example here:
Solved: Re: How to use eval if there is no result from the... - Splunk Community

[PickleRick]

If you're using the timechart command, it generates zero count for periods when there is no values. Otherwise you need to use this approach https://www.duanewaddle.com/proving-a-negative/

[ITWhisperer]

| eval results=if(results=0,"No events Found",results)

[Richy_s]

@ITWhisperer Thank you for your response.  But it did not work.  I don't get any results.

[ITWhisperer]

Please share your full search so we might be able to determine why you are not getting any results.

[Richy_s]

So I have a data source which is very low volume and is not expected to have events at all (like only if there is an unexpected event, it logs that).  I have a requirement to produce a report showing there were no unexpected events in last 90days. I tried following search query but it is not giving the results per day.

index=foo  | timechart span=1d count as event_count by sourcetype | append [|stats count as event_count | eval text="no events found"]

PS - the count you are seeing below is for the other sourceytpe that is under the same index=foo, and the sourcetype where the count is 0 is displayed at the bottom ( sourcetype name is not displayed as there are no events for that sourcetype).

I want my output to be specific to this sourcetype and display count = 0 for all the days where the data is not present.

[ITWhisperer]

If you know all the sourcetypes you are interested in (A, B, C, D, E, F in my example), you could do something like this

| timechart span=1d count as event_count by sourcetype usenull=f
| foreach A B C D E F
    [| eval <<FIELD>>=coalesce(<<FIELD>>,0)
    | eval <<FIELD>>=if(<<FIELD>>==0,"No events found",<<FIELD>>)]

[Richy_s]

Thank you @ITWhisperer.  This seems to be working however it is not displaying the "No events found" where there are 0 or blank events. Attached snapshot below.  Also, can you please explain the query.

[ITWhisperer · Accepted solution]

Try putting the <<FIELD>> on the right-hand side of the assignment in single quotes (since you have chosen to hide your sourcetypes, it could be that they have special characters in which the single quotes will deal with)

| timechart span=1d count as event_count by sourcetype usenull=f
| foreach A B C D E F
    [| eval <<FIELD>>=coalesce('<<FIELD>>',0)
    | eval <<FIELD>>=if('<<FIELD>>'==0,"No events found",'<<FIELD>>')]