Splunk Search

Need to display count having zero events


I am having below search string and suppose the file "magic_new.log" has no events and the requirement is to show that as output

index=magic  source IN ("D:\\show\\magic.log", "D:\\show\\magic_new.log", "D:\\show\\magic_old.log")
| stats count by source
| where count=0

current output-
no results found

expected output-
source                                                    count
D:\show\magic_new.log                0 

(Note: Tried multiple solutions suggested in the community but none worked)

Labels (1)
Tags (2)
0 Karma

Ultra Champion

Well, that's understandable firstly you select events using a set of constraints (in this case, possible index names), then you do a statistical operation on this set of events. Splunk in the | stats step doesn't know the original conditions. It only knows the events that have been supplied from the search.

If the filenames are known beforehand, you might prepare a static table using a lookup or an inline search with count=0 and then sum your results with those prepared earlier.

something like:

index=magic source IN ("D:\\show\\magic.log", "D:\\show\\magic_new.log", "D:\\show\\magic_old.log")
| stats count by source | append [ | makeresults
| eval _raw="D:\\show\\magic.log
| multikv noheader=t
| rename Column_1 as source
| table source
| eval count=0 ] | stats sum(count) by source

Ugly as hell but should do.

If you have the filenames in a lookup you could just use inputlookup instead of all this consturction within [] (and use the lookup to generate constraints for the search as well- that way you have your search consistent.


@PickleRick Thanks!....but when I tried for similar kind of source with name as- "D:\\show\\*.log"  where * is dd-mm-yyyy  it gives multiple entries of output as-

source                                                          sum(count)
D:\\show\\*.log                                        0
D:\\show\\30-08-2021.log                 0

whereas required one is only-
D:\\show\\30-08-2021.log                 0

do I need to make any changes in eval _raw, that you mentioned

0 Karma

Ultra Champion

It won't work with glob patterns. It can't. Remember - as I wrote before - if you have your events as an output of the search (and want to do some further analysis like | stat) splunk doesn't know anymore what were the criteria you were searching by. So my walkaround was not letting you match filenames from "the input". It was just predicting the output.
You probably could do some magic to match with glob patterns or any other kind of match but that would involve either some kind of more complicated lookup matching or using some fancy evals.

Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...