Splunk Search

Replace no value with "0" (zero)

swengroeneveld
Explorer

Hi all,

Since a few days I am in a battle regarding the following and I am on the loosing edge here. So all help is wanted of course.

Instead of "no result found" in the graph area, I want to have a visual but in that case all "0".

My query is as follows:

index=index host=test 
| rex field=_raw "(?ms)^(?:[^ \\n]* ){6}(?P<SyslogMessage>[^:]+)(?:[^ \\n]* ){7}(?P<src_ip>[^ ]+) to (?P<dest_ip>[^ ]+)"  
| eval msg = if(match(SyslogMessage,"%ABC-1-*"),"alert", if(match(SyslogMessage,"%ABC-2-*"),"critical","Other"))
| Search NOT msg="other"
| timechart span=360s count(msg) as cnt, first(BaseLine) as Baseline by msg
| eval BaseLine=8

I tried several options such as before the last |eval BaseLine=8:

| fillnull value=0 cnt

Looking for some magic.

S

Tags (2)
0 Karma

to4kawa
Ultra Champion
|  timechart span=360s count(msg) as cnt, first(BaseLine) as Baseline by msg

please provide the results.

_time cnt: alert cnt: critical cnt: other Baseline: alert Baseline: critical Baseline: other

Is this?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...