Splunk Search

How to return 0 when the search has no results in time chart

Builder

I am trying to see how can we return 0 if no results are found using timechart for a span of 30minutes.i tried using fill null but its not working

index=abc  sourcetype=qwe HTTP_Code=502 |timechart span=30m count |fillnull value=0

but when I am using a stats command I get the count as 0.

index=abc  sourcetype=qwe HTTP_Code=502 |stats count

output
count-0

0 Karma
1 Solution

Revered Legend

Try like this

index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time | table _time count]

Updated

index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count | appendpipe [| stats count | where count=0 | addinfo | eval time=info_min_time." ".info_max_time | table time count | makemv time| mvexpand time | rename time as _time | timechart span=30m max(count) as count]

View solution in original post

Revered Legend

Try like this

index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time | table _time count]

Updated

index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count | appendpipe [| stats count | where count=0 | addinfo | eval time=info_min_time." ".info_max_time | table time count | makemv time| mvexpand time | rename time as _time | timechart span=30m max(count) as count]

View solution in original post

Builder

I tried this but the output gives you only one time, I am trying to break down into buckets of 30 minutes

Revered Legend

Try the updated answer

0 Karma

Splunk Employee
Splunk Employee

the update one is the one works for me !

0 Karma

Builder

That worked thank you very much you are always helpful

0 Karma

Super Champion

try using |makecontinuous span=30m _time |timechart span=30m count

https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Makecontinuous

0 Karma

Builder

No luck with that

0 Karma