Splunk Search

How to return 0 when the search has no results in time chart

vrmandadi
Builder

I am trying to see how can we return 0 if no results are found using timechart for a span of 30minutes.i tried using fill null but its not working

index=abc  sourcetype=qwe HTTP_Code=502 |timechart span=30m count |fillnull value=0

but when I am using a stats command I get the count as 0.

index=abc  sourcetype=qwe HTTP_Code=502 |stats count

output
count-0

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time | table _time count]

Updated

index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count | appendpipe [| stats count | where count=0 | addinfo | eval time=info_min_time." ".info_max_time | table time count | makemv time| mvexpand time | rename time as _time | timechart span=30m max(count) as count]

View solution in original post

somesoni2
Revered Legend

Try like this

index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time | table _time count]

Updated

index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count | appendpipe [| stats count | where count=0 | addinfo | eval time=info_min_time." ".info_max_time | table time count | makemv time| mvexpand time | rename time as _time | timechart span=30m max(count) as count]

vrmandadi
Builder

I tried this but the output gives you only one time, I am trying to break down into buckets of 30 minutes

somesoni2
Revered Legend

Try the updated answer

0 Karma

jackw_splunk
Splunk Employee
Splunk Employee

the update one is the one works for me !

0 Karma

vrmandadi
Builder

That worked thank you very much you are always helpful

0 Karma

cmerriman
Super Champion

try using |makecontinuous span=30m _time |timechart span=30m count

https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Makecontinuous

0 Karma

vrmandadi
Builder

No luck with that

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>