How to remove blank cells in the statistics table?

[ccsfdave]

Greetings,

I am running the search attached in the image (I'll paste the text below as well).

index=security sourcetype=cisco mickey_mouse duration=* | rex "\((?<username>[\w_]+)\)$" |timechart span=1d sum(duration) as sumdur | eval "Time Connected"=tostring(sumdur, "duration") |fields - sumdur |rename _time as Date | convert timeformat=%m/%d/%Y ctime(Date)

I am getting results for many days, not all. This looks at VPN connections and totals the time connected per day. It could be that missing dates means there was no connection and blanks in "Time Connected" means it was a very brief connection. Can anyone think of a way to remove the blanks or have them say 0?

Thanks,

Dave

[MuS · Accepted solution]

Hi ccdfdave,

Take a look at the fillnull command http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Fillnull and try something like this at the end :

 ..... | fillnull value=0 "Time Connected"

cheers, MuS

[ccsfdave]

MuS,

That indeed filled the blank cells with zeros. I would kinda like to get rid of those rows but short of that, I can accept the 0.

Thanks,

Dave