Splunk Search

How to force the display of a value when the search is empty?

Rajaion
Path Finder

Hello community,

I have a problem with a search that does not return a result. For the purposes of a dashboard, I need one of my searches, when it does not return a result, to display 0.
I have already succeeded in this modification in some somewhat complex searches but for a fairly simple search, I cannot do it. Here is the example in question:

Rajaion_0-1661769046030.png

Note that when I have a result, it is displayed well, my search runs correctly.

I attempted to use the command "| eval ACKED = if(isnull(ACKED) OR len(ACKED)==0, "0", ACKED)" but search doesn't seem to read it:

Rajaion_1-1661769123946.png

 

I found several topics on similar subjects (with the use of fillnull for example) but without result :

Rajaion_2-1661769157029.png

 

I think it's not complicated but I can't put my finger on what's the problem, do you have any idea?

Best regards,

Rajaion

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Rajaion,

after the last stats and the final table commands, add the following rows:

| append [| makeresults | eval ACKED=0 | fields ACKED]
| stats sum(ACKED) AS ACKED

I asked to Splunk Ideas to add this feature to panels and it is in evaluation for a future prospect, if you think that it's a good idea, vote for it at https://ideas.splunk.com/ideas/EID-I-572 .

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Rajaion,

after the last stats and the final table commands, add the following rows:

| append [| makeresults | eval ACKED=0 | fields ACKED]
| stats sum(ACKED) AS ACKED

I asked to Splunk Ideas to add this feature to panels and it is in evaluation for a future prospect, if you think that it's a good idea, vote for it at https://ideas.splunk.com/ideas/EID-I-572 .

Ciao.

Giuseppe

Rajaion
Path Finder

Hi @gcusello ,

This is exactly what I was looking for, I hadn't thought of this function (which I will dig into to better understand how it works).

Thank you very much for your help, my dashboards are perfect now!

I voted for your idea, indeed, a simple button for this kind of thing should exist.

Best regards,

Rajaion

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...