Splunk Search

How to display 0 when there is No Records Found or Nothing returned

splunkbeginner
Engager

the search (thanks for who provided this) is:

| tstats count where host=linux01 sourcetype="linux:audit" by _time span=1d prestats=t
| timechart span=1d count as total
| appendcols [ search host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls)
| timechart span=1d count as filter]

If there is no matched event to return for "total" and "filter", I get "Not Results Found". If there is no matched event return for "total" or "filter", I get nothing on the timechart for "total" or "filter"

I would instead like a 0 displayed. Any idea will be much appreciated.

Tags (1)
0 Karma

harishalipaka
Motivator

@splunkbeginner

try like this

| tstats count where host=linux01 sourcetype="linux:audit" by _time span=1d prestats=t
| timechart span=1d count as total
| appendcols [ search host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls)
| timechart span=1d count as filter]
| stats count as total by sourcetype
 | appendpipe [ stats count as total
 | where total=0
 | eval total=0,filter=0]
Thanks
Harish
0 Karma

splunkbeginner
Engager

@harishalipaka

thanks but it somehow doesn't work for me.

nevertheless i tried a query from another splunk answer and its working fine.
| appendpipe [ stats count | eval "NoResults"="0" | where count=0 |table "NoResults"]

0 Karma

to4kawa
Ultra Champion
....
| appendpipe [| stats count as total
| where total=0
| eval total=0]
0 Karma

splunkbeginner
Engager

@to4kawa

thanks but still I get nothing on the timechart for "total" or "filter" when there is no matched event return for "total" or "filter",

0 Karma

to4kawa
Ultra Champion
index=_internal "nothing counts"
| stats count as total by sourcetype
| appendpipe [ stats count as total
| where total=0
| eval total=0]
0 Karma

splunkbeginner
Engager

@to4kawa

thanks again. maybe i don't know how to fit your suggestion to my search... but thanks anyway.

nevertheless i tried a query from another splunk answer and its working fine.
| appendpipe [ stats count | eval "NoResults"="0" | where count=0 |table "NoResults"]

0 Karma

to4kawa
Ultra Champion
0 Karma

splunkbeginner
Engager

@to4kawa

Thanks for the link. Any idea how i can tune the appendage to yield correct events? Thanks

| tstats count where host=linux01 sourcetype="linux:audit" by _time span=1d prestats=t
| timechart span=1d count as total
| appendcols [ search host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls)
| timechart span=1d count as filter]
| appendpipe
[| timechart count
| where count=0
| eval ???,count=0
| appendpipe
[| eval ???,count=0]]

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...