Splunk Search

Search to show zero when no results

matthewcanty
Communicator

I have the following search:

earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | timechart span=30m count

At the moment there are no results. And I get the "No results..." message.
But I want to see a 0 for every 30-minute timespan between 1100 and 2200.
How do I do this?

If there was a single result I get the full table- but if there were results then an alert would not trigger.

Thanks,
Matt

Tags (3)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi matthewcanty

you can use fillnull on your search and you will get 0 for every empty field

... | fillnull

read more here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull

cheers, MuS

View solution in original post

splunk_kk
Path Finder

Try this:

earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | append [| search | fields - * | eval count=0] | timechart span=30m count

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi matthewcanty

you can use fillnull on your search and you will get 0 for every empty field

... | fillnull

read more here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull

cheers, MuS

MuS
SplunkTrust
SplunkTrust

Greetings from the future,

you can run a search like this:

index=_internal 
| stats count by sourcetype 
| append 
    [| stats count 
    | eval sourcetype=if(isnull(sourcetype), "Nothing to see here, move along!", sourcetype)] 
| streamstats count AS line_num 
| eval head_num=if(line_num > 1, line_num - 1, 1) | where NOT ( count=0 AND head_num < line_num ) | table sourcetype count

cheers, MuS

MuS
SplunkTrust
SplunkTrust

Hmm it looks like this only works, if your search returns at least one event....

harry2007gsp
Path Finder

Yes, same thing is happening on my side. Fillnull is made for returning value for null attributes but the condition is to have at least a row of results. When there are no results at all, there is no fillnull working in that condition.

0 Karma

matthewcanty
Communicator

Doesn't work anyway guys.

0 Karma

MuS
SplunkTrust
SplunkTrust

out luck /K was not around, he would have answered this loooong before us 🙂

sdaniels
Splunk Employee
Splunk Employee

MuS you beat me to it.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...