Splunk Search

If there are no results found, how do I get my search to return a field that has the value of zero?

Path Finder

I have the following search:

index=ad source=otl_adgroupmemberscan memberSamAccountName=jbloggs
|dedup memberSamAccountName, groupSamAccountName
|table groupSamAccountName, memberSamAccountName

If there are no results, I want it to show a field that have a value of zero.

If there are results though, it's important the search still returns all of the values of groupSamAccountName and memberSamAccountName

Tags (3)
0 Karma
1 Solution

Super Champion
index=ad source=otl_adgroupmemberscan memberSamAccountName=jbloggs
|dedup memberSamAccountName, groupSamAccountName
|table groupSamAccountName, memberSamAccountName
| appendpipe [ stats count | eval "NoResults"="0"  | where count=0 |table "NoResults"]

you could name the "NoResults" field to groupSamAccountName or memberSamAccountName and it would replace that field value if there are no results.

View solution in original post

Super Champion
index=ad source=otl_adgroupmemberscan memberSamAccountName=jbloggs
|dedup memberSamAccountName, groupSamAccountName
|table groupSamAccountName, memberSamAccountName
| appendpipe [ stats count | eval "NoResults"="0"  | where count=0 |table "NoResults"]

you could name the "NoResults" field to groupSamAccountName or memberSamAccountName and it would replace that field value if there are no results.

View solution in original post

Path Finder

Thank you! this worked exactly how I wanted it to.

0 Karma