Splunk Search

How to add zeros to table when data is not found

komalg
New Member

Hello,

Have a question for the community: I have a table that looks like this:
ADate Type
2019-12-01 ABC
2019-12-02 ABC
2019-12-02 XYZ
2019-12-03 XYZ

When I run ..... |stats count by A , Type- I get only the counts of Types that are there on that date.

I want to append the count of 2019-12-01 for XYZ as 0 , 2019-12-03 ABC as 0 like that in my result.
Any help with this?

Thanks.

0 Karma

DavidHourani
Super Champion

Hi @komalg,

You can use the fillnull command as follows to put zeros everywhere (just like my school grades) in case your search is |stats count by A:

... | fillnull 

But if you want to use |stats count by ADate, Type- then you're actually better off going for something like this :

...| eval _time=strptime(ADate,%Y-%m-%d) |timechart count by Type

Let me know if that helps.

Cheers,
David

0 Karma

komalg
New Member

Thanks, stats does not work, but I am able to work with timechart.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...