Splunk Search

How to force the display of a value when the search is empty?

Rajaion
Path Finder

Hello community,

I have a problem with a search that does not return a result. For the purposes of a dashboard, I need one of my searches, when it does not return a result, to display 0.
I have already succeeded in this modification in some somewhat complex searches but for a fairly simple search, I cannot do it. Here is the example in question:

Rajaion_0-1661769046030.png

Note that when I have a result, it is displayed well, my search runs correctly.

I attempted to use the command "| eval ACKED = if(isnull(ACKED) OR len(ACKED)==0, "0", ACKED)" but search doesn't seem to read it:

Rajaion_1-1661769123946.png

 

I found several topics on similar subjects (with the use of fillnull for example) but without result :

Rajaion_2-1661769157029.png

 

I think it's not complicated but I can't put my finger on what's the problem, do you have any idea?

Best regards,

Rajaion

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Rajaion,

after the last stats and the final table commands, add the following rows:

| append [| makeresults | eval ACKED=0 | fields ACKED]
| stats sum(ACKED) AS ACKED

I asked to Splunk Ideas to add this feature to panels and it is in evaluation for a future prospect, if you think that it's a good idea, vote for it at https://ideas.splunk.com/ideas/EID-I-572 .

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Rajaion,

after the last stats and the final table commands, add the following rows:

| append [| makeresults | eval ACKED=0 | fields ACKED]
| stats sum(ACKED) AS ACKED

I asked to Splunk Ideas to add this feature to panels and it is in evaluation for a future prospect, if you think that it's a good idea, vote for it at https://ideas.splunk.com/ideas/EID-I-572 .

Ciao.

Giuseppe

Rajaion
Path Finder

Hi @gcusello ,

This is exactly what I was looking for, I hadn't thought of this function (which I will dig into to better understand how it works).

Thank you very much for your help, my dashboards are perfect now!

I voted for your idea, indeed, a simple button for this kind of thing should exist.

Best regards,

Rajaion

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...