Splunk Search

How can I set my count to '0' when no results are found in a table with the corresponding source?

RocIngersol
Explorer

Hi Folks,

I want to produce a count of events in each of my indexes. Where there isn't any data for the time range I specify in my search, I want to return 0 next to the corresponding index. So far I've tried;

index=blah* |timechart span=5m count by index | append pipe [stats count | where count==0]

The above returns 0 - but how can I add in the corresponding index name that has 0?

thx!

R

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

index=blah* |timechart span=5m count by index 
| table [| rest /services/data/indexes | table title | search title=blah* | rename title as search]
| fillnull value=0

lfedak_splunk
Splunk Employee
Splunk Employee

Here's more info about fillnull! http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Fillnull Just learned about it in the Splunk Fundamentals II course myself. 😄 You can use the fillnull command to replace all null values with 0 or any string that you’d like

0 Karma

RocIngersol
Explorer

Thx for the reply. Yeah I've used fillnill a few times - in this case (where there is no data in the index for the specified search time window I still get 'no results found' as opposed to my wanted index_name count 0

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try then...

index=blah* | bucket span=5m _time | stats count by _time index  
| appendpipe [| stats count | where count=0 | addinfo 
| eval time=split(info_min_time." ".info_max_time," ") | table time count| mvexpand time 
| rename time as _time  | eval index="dummy"] |timechart span=5m count by index 
 | table _time [| rest /services/data/indexes | table title | search title=blah* | rename title as search]
 | fillnull value=0
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...