Splunk Search

How do you use fillnull to return a count of 0?

michael_ermino_
New Member

I have events that have a value called "Date First Found" that is of the format: "%m/%d/%Y". I calculate the number of days since this date, and group them based on their age. In the example below, the grouping is between 180 and 365 days. For this particular group there are no search results at the moment, so I want to return a count of 0. I tried using fillnull, however this does not work and only returns "No results found".

Am I missing something here?

search query | eval dateFirstFound=strptime('Date First Found', "%m/%d/%Y") | eval days_open = round((now()-dateFirstFound)/86400) | search (days_open>=181 AND days_open <=365) | bin span=1d _time | stats count by _time | fillnull value=0 count
0 Karma

woodcock
Esteemed Legend

Use the default behavior of timechart to create empty time buckets like this:

search query 
| eval dateFirstFound=strptime('Date First Found', "%m/%d/%Y") 
| eval days_open = round((now()-dateFirstFound)/86400) 
| search (days_open>=181 AND days_open <=365) 
| timechart span=1d count

richgalloway
SplunkTrust
SplunkTrust

While your approach is logical, it doesn't work. Use appendpipe.

search query | eval dateFirstFound=strptime('Date First Found', "%m/%d/%Y") 
| eval days_open = round((now()-dateFirstFound)/86400) 
| search (days_open>=181 AND days_open <=365) 
| bin span=1d _time 
| stats count by _time
| appendpipe [ stats count | eval daysCount=0 | where count==0 | fields - count | rename daysCount as count ]
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...