Hi, I wonder whether someone may be able to help me please.
I'm using the following stats query.
`wso2_wmf(RequestCompleted)` | dedup eventId | stats count by request.detailContext
The problem I have is that it's not displaying zero values for the request.detail.Context field.
If I use '| fillnull value=0' then specify each value from the request.detail.Context field then it does display those values with a zero count.
But the problem with this, is that because I'm being prescriptive in field values, when new field values are being ingested into Splunk for this field, they are not being extracted in the stats table.
I've looked at every post I could find of a similar nature and the solutions provided haven't worked. Could someone perhaps have a look at this and offer some guidance on how I may go about achieving this.
Many thanks and kind regards
Might not be the answer, but an idea how to handle the case where the base search does not return events .... read here : https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html