Splunk Search

Fillnull not working on my search

markhvesta
Path Finder

I am trying to get the following query to work, but if there are no InPerson orders, no results are shown for the Channel instead of a row with 0 orders.

 sourcetype="CustomerOrders"
| search (Channel = Store 
OR Channel = InPerson)
| chart count as Count by Channel
|fillnull
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The fillnull command will add values to fields within a row, but does not create rows that don't exist.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...