How do I display the result of a search in a table even if there is no event?

[jip31]

Hello,

I would like to know how to display results in a count table (count = 0) even if the search doesn't return events?

For example, with the request below, il would like to have

Type                    EventCode    Count
Critique                  51            0
Advertisement               51         0

index=windows sourcetype="wineventlog:system" SourceName="Disk" EventCode=11 (Type="Critique" OR Type="Avertissement") 
    | eval Mois=strftime(_time,"%Y-%m") 
    | stats count by Mois,Type, EventCode| where count >3 | sort -Mois

THANKS

[MousumiChowdhur]

Hi @jip31 ,

Can you try using * | fillnull value=0 ? Let me know if that's working for you.

Thank You!

[pramit46]

@jip31

I see that you are ignoring the values of count <=3, which is why the rows with count 0 are disappearing. How about you remove that restriction, and use and eval instead to change the values of count<=3 to 0.

|eval count=if(count>3, count, 0)

Try this and let me know if it helps.

[jip31]

it s good for i want thanks
i also need something like this in the same dashboard
but i want to display the line result even if count=0 by type
it means that if for a month I have no result for a critical event i still want to display the line result
is it possible?

[pramit46]

@jip31,
Have you tried timechart command instead of stats? you can use span=1mon and it would show the counts per month. It would also show if the count is 0. Then you can choose whether to keep them or not.

See if that helps.

[Vijeta]

you could do makeresults , try below code and tweak as per your requirement

index=windows sourcetype="wineventlog:system" SourceName="Disk" EventCode=11 (Type="Critique" OR Type="Avertissement") 
     | eval Mois=strftime(_time,"%Y-%m") 
     | stats count by Mois,Type, EventCode| where count >3 | sort -Mois| append[|makeresults|eval Type="Critique" ,count=0 | appendpipe[|eval Type="Critique" ,count=0]]

[jip31]

hello it doesnt works because it just display critical event = 0 without the eventcode and with _time instead Mois
and it is not also combined with Avertissements results