Splunk Search

How to show the line when its value is NULL with chart command / chartコマンドで行の値が0の時表示する方法

mint_choco
Explorer

Hi, I try to display the number of events per day from multiple indexes.

I wrote the below SPL, but when all index values are null for a specific date, the line itself is not displayed.

複数のindexから、nullには0を代入し、1日ごとのイベント件数を表示させたいです。

chartコマンドを使いイベント件数を表示、特定indexの値がnullの場合はisnullで0を代入できたのですが、特定の日にちだけ全てのindexの値がnullの時、その日の行自体が表示されません。

index IN (index1, index2, index3, index4)
| bin span=1d _time
| chart count _time over index
| eval index4=if(isnull(index4), 0, index4)

How to display a line of 4/2 by substituting 0 like the below table, when all indexes value of 4/2 are null?

下記の表のように4/2の値がなくとも、0を代入して4/2の行を表示させる方法はないでしょうか。

 index1index2index3index4
4/1123450
4/20000
4/3167340
Labels (3)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

There are several ways to do this.  A traditional method is to backfill every day.

index IN (index1, index2, index3, index4)
| bin span=1d _time
| chart count _time over index
| append
    [ makeresults
    | timechart span=1d@d count
    | fields - count]
| stats values(*) as * by _time
| fillnull

Note I replaced your last line with fillnull. (This command is worth learning.)

Another somewhat sneaky way to do this depends on the real stats you perform.  If it is simple stats such as count, you can just "sneak in" something that always have some value, such as index _internal.

index IN (index1, index2, index3, index4, _internal)
| bin span=1d _time
| chart count _time over index
| fields - VALUE_internal
| fillnull
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...