Splunk Search

How to search all events and corresponding volume, but display the volume as "0" for missing events?

nasamajh09
New Member

I'm search to fetch the volume against different events in a given time frame. The problem I'm running into is that if one or more of those events that did not process any records during that time frame, they do not show up in the output. What search should I use to display volume as 0 with those missing events? Missing events should display with volume as 0 in the search output. Any help will be appreciated ..

Tags (2)
0 Karma

MuS
Legend

Hi nasamajh09,

take a look at this answer https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html which show a way how to do it.
In your case you could do something like this:

your base search here to get all events
| eval volume=if(isnotnull(volume), volume, "0")
| do more stuff here

This will search in your events for the field volume and if it is not null it will uses the value of volume otherwise it will be set to 0.

Hope this helps ...

cheers, MuS

0 Karma

nasamajh09
New Member

Thank You MuS for your answer but it won't work because if there is no logs for any event ,event name will not appear while searching ,so no point of using isnotnull.

0 Karma

MuS
Legend

Indeed, my answer was not complete. Refere to the other answer and follow the three steps after the base search and you should get it working.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...