How to Fill Null for fail or exception

[indeed_2000]

Hi

here is my spl, that show different status:

index="myindex" | rex "status\[(?<status>\w+)"| stats count(status) by status

here is the current result:

status                       count(status)
successful             3581

here is the exception result:

status                       count(status)
successful             3581

fail                                0

exception                0

FYI: some time fail or exception might bot be in log file some time might be exist, neet to show in stats result even if these stats not exist.

Any idea?

Thanks

[ITWhisperer · Accepted solution]

Try something like this

| append [
  | makeresults
  | fields - _time
  | eval status=split("exception|fail","|")
  | mvexpand status
  | eval "count(status)" = 0]
| stats sum(*) as * by status

[indeed_2000]

Thanks it work, How can I add total column, like below?

status                       count(status)
successful             3581

fail                                0

exception                0

total                              3581

[ITWhisperer]

LMGTFY

addtotals - Splunk Documentation

[indeed_2000]

before ask here use addtotals but status field is empty and try label but create another column.

current output:

status                count(status)
Exception        0
Fail                       0
successful     3581
                              3581

expected output:

status                count(status)
Exception        0
Fail                       0
successful     3581
total                    3581