Splunk Search

How to add zeros to table when data is not found

komalg
New Member

Hello,

Have a question for the community: I have a table that looks like this:
ADate Type
2019-12-01 ABC
2019-12-02 ABC
2019-12-02 XYZ
2019-12-03 XYZ

When I run ..... |stats count by A , Type- I get only the counts of Types that are there on that date.

I want to append the count of 2019-12-01 for XYZ as 0 , 2019-12-03 ABC as 0 like that in my result.
Any help with this?

Thanks.

0 Karma

DavidHourani
Super Champion

Hi @komalg,

You can use the fillnull command as follows to put zeros everywhere (just like my school grades) in case your search is |stats count by A:

... | fillnull 

But if you want to use |stats count by ADate, Type- then you're actually better off going for something like this :

...| eval _time=strptime(ADate,%Y-%m-%d) |timechart count by Type

Let me know if that helps.

Cheers,
David

0 Karma

komalg
New Member

Thanks, stats does not work, but I am able to work with timechart.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...