Splunk Search

Modifying stats count to include fields with zero-values

HallGM
Engager

I have some data with a field called "priority", which has a value from P1 -> P5.

this search query:

...
| stats count as Quantity by priority

 

produces a table that looks something like this:

priorityQuantity
P21
P31
P46
P53

 

As you can see,  there are no data entries with a priority of "P1". However, I would like to actually include that as a row in the table and show that there is a quantity of "0". Ideally I would want to include all 5 priority levels for any dataset, even when they are empty

Can anyone help and let me know how I can do this? Is there a way to specify which values to count?

Labels (1)
0 Karma
1 Solution

johnhuang
Motivator

 

...
| eval count=1
| append [| makeresults | eval priority=SPLIT("P1,P2,P3,P4,P5", ",") | mvexpand priority | eval count=0]
| stats sum(count) AS Quantity BY priority

 

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

Use below:

| append [| makeresults | eval priority=split("P1,P2,P3,P4,P5", ",") | mvexpand priority | eval count=0]
| stats sum(count) AS Quantity BY priority
0 Karma

johnhuang
Motivator

 

...
| eval count=1
| append [| makeresults | eval priority=SPLIT("P1,P2,P3,P4,P5", ",") | mvexpand priority | eval count=0]
| stats sum(count) AS Quantity BY priority

 

Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...