Search to show zero when no results

[matthewcanty]

I have the following search:

earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | timechart span=30m count

At the moment there are no results. And I get the "No results..." message.
But I want to see a 0 for every 30-minute timespan between 1100 and 2200.
How do I do this?

If there was a single result I get the full table- but if there were results then an alert would not trigger.

Thanks,
Matt

[splunk_kk]

Try this:

earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | append [| search | fields - * | eval count=0] | timechart span=30m count

[the_wolverine]

http://answers.splunk.com/answers/118496/fill-in-0-for-timechart-with-missing-values

[MuS · Accepted solution]

Hi matthewcanty

you can use fillnull on your search and you will get 0 for every empty field

... | fillnull

read more here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull

cheers, MuS

[MuS]

Greetings from the future,

you can run a search like this:

index=_internal 
| stats count by sourcetype 
| append 
    [| stats count 
    | eval sourcetype=if(isnull(sourcetype), "Nothing to see here, move along!", sourcetype)] 
| streamstats count AS line_num 
| eval head_num=if(line_num > 1, line_num - 1, 1) | where NOT ( count=0 AND head_num < line_num ) | table sourcetype count

cheers, MuS

[MuS]

Hmm it looks like this only works, if your search returns at least one event....

[harry2007gsp]

Yes, same thing is happening on my side. Fillnull is made for returning value for null attributes but the condition is to have at least a row of results. When there are no results at all, there is no fillnull working in that condition.

[matthewcanty]

Doesn't work anyway guys.

[MuS]

out luck /K was not around, he would have answered this loooong before us 🙂

[sdaniels]

MuS you beat me to it.