How to assign a default value to the count when there are no events?

[bollam]

I have got five places in the field="location". I want to find if there is no login's happened based on the location.

I need only require the results if there are no events in Splunk from a specific field. For an instance.
If no one has logged in from the location="Hyderabad" and location="Bangalore" then the count should be assigned with a value as "1" by default.

I can get the count if there are events but not from the location where there are no events.

The output should look like below:
location      1
Hyderabad     1
Bangalore     1

[gcusello · Accepted solution]

Hi bollam,
let me understand: how you can understand when from "Hyderabad" you have only one access (count=1) or no access (count=0)
?
you instead could give the zero value to a location when there isn't any access using an easy way:

• create a lookup (called e.g. locations.csv) with one column (called e.g. location) containing all the locations;

• run a search like this:

  index=my_index
  | stats count by location
  | append [ | inputlookup locations.csv | eval count=0 | fields location count ]
  | stats sum(count) AS Total BY location

In this way location with Total=0 aren't accessed.

You can filter locations BY Total and create an alert or display table in graphic mode (see Splunk 7.x Dashboard Examples App).

Bye.
Giuseppe

[bollam]

Typo in the question.

Output should look like below:

location count
Hyderabad 1
Bangalore 1