Splunk Search

Search to show zero when no results

matthewcanty
Communicator

I have the following search:

earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | timechart span=30m count

At the moment there are no results. And I get the "No results..." message.
But I want to see a 0 for every 30-minute timespan between 1100 and 2200.
How do I do this?

If there was a single result I get the full table- but if there were results then an alert would not trigger.

Thanks,
Matt

Tags (3)
0 Karma
1 Solution

MuS
Legend

Hi matthewcanty

you can use fillnull on your search and you will get 0 for every empty field

... | fillnull

read more here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull

cheers, MuS

View solution in original post

splunk_kk
Path Finder

Try this:

earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | append [| search | fields - * | eval count=0] | timechart span=30m count

0 Karma

MuS
Legend

Hi matthewcanty

you can use fillnull on your search and you will get 0 for every empty field

... | fillnull

read more here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull

cheers, MuS

MuS
Legend

Greetings from the future,

you can run a search like this:

index=_internal 
| stats count by sourcetype 
| append 
    [| stats count 
    | eval sourcetype=if(isnull(sourcetype), "Nothing to see here, move along!", sourcetype)] 
| streamstats count AS line_num 
| eval head_num=if(line_num > 1, line_num - 1, 1) | where NOT ( count=0 AND head_num < line_num ) | table sourcetype count

cheers, MuS

MuS
Legend

Hmm it looks like this only works, if your search returns at least one event....

harry2007gsp
Path Finder

Yes, same thing is happening on my side. Fillnull is made for returning value for null attributes but the condition is to have at least a row of results. When there are no results at all, there is no fillnull working in that condition.

0 Karma

matthewcanty
Communicator

Doesn't work anyway guys.

0 Karma

MuS
Legend

out luck /K was not around, he would have answered this loooong before us 🙂

sdaniels
Splunk Employee
Splunk Employee

MuS you beat me to it.

Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...