Splunk Search

Replace no value with "0" (zero)

swengroeneveld
Explorer

Hi all,

Since a few days I am in a battle regarding the following and I am on the loosing edge here. So all help is wanted of course.

Instead of "no result found" in the graph area, I want to have a visual but in that case all "0".

My query is as follows:

index=index host=test 
| rex field=_raw "(?ms)^(?:[^ \\n]* ){6}(?P<SyslogMessage>[^:]+)(?:[^ \\n]* ){7}(?P<src_ip>[^ ]+) to (?P<dest_ip>[^ ]+)"  
| eval msg = if(match(SyslogMessage,"%ABC-1-*"),"alert", if(match(SyslogMessage,"%ABC-2-*"),"critical","Other"))
| Search NOT msg="other"
| timechart span=360s count(msg) as cnt, first(BaseLine) as Baseline by msg
| eval BaseLine=8

I tried several options such as before the last |eval BaseLine=8:

| fillnull value=0 cnt

Looking for some magic.

S

Tags (2)
0 Karma

to4kawa
Ultra Champion
|  timechart span=360s count(msg) as cnt, first(BaseLine) as Baseline by msg

please provide the results.

_time cnt: alert cnt: critical cnt: other Baseline: alert Baseline: critical Baseline: other

Is this?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...