Splunk Search

Search to show zero when no results

matthewcanty
Communicator

I have the following search:

earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | timechart span=30m count

At the moment there are no results. And I get the "No results..." message.
But I want to see a 0 for every 30-minute timespan between 1100 and 2200.
How do I do this?

If there was a single result I get the full table- but if there were results then an alert would not trigger.

Thanks,
Matt

Tags (3)
0 Karma
1 Solution

MuS
Legend

Hi matthewcanty

you can use fillnull on your search and you will get 0 for every empty field

... | fillnull

read more here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull

cheers, MuS

View solution in original post

splunk_kk
Path Finder

Try this:

earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | append [| search | fields - * | eval count=0] | timechart span=30m count

0 Karma

MuS
Legend

Hi matthewcanty

you can use fillnull on your search and you will get 0 for every empty field

... | fillnull

read more here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull

cheers, MuS

MuS
Legend

Greetings from the future,

you can run a search like this:

index=_internal 
| stats count by sourcetype 
| append 
    [| stats count 
    | eval sourcetype=if(isnull(sourcetype), "Nothing to see here, move along!", sourcetype)] 
| streamstats count AS line_num 
| eval head_num=if(line_num > 1, line_num - 1, 1) | where NOT ( count=0 AND head_num < line_num ) | table sourcetype count

cheers, MuS

MuS
Legend

Hmm it looks like this only works, if your search returns at least one event....

harry2007gsp
Path Finder

Yes, same thing is happening on my side. Fillnull is made for returning value for null attributes but the condition is to have at least a row of results. When there are no results at all, there is no fillnull working in that condition.

0 Karma

matthewcanty
Communicator

Doesn't work anyway guys.

0 Karma

MuS
Legend

out luck /K was not around, he would have answered this loooong before us 🙂

sdaniels
Splunk Employee
Splunk Employee

MuS you beat me to it.

Get Updates on the Splunk Community!

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...