I have the following search:
earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | timechart span=30m count
At the moment there are no results. And I get the "No results..." message.
But I want to see a 0 for every 30-minute timespan between 1100 and 2200.
How do I do this?
If there was a single result I get the full table- but if there were results then an alert would not trigger.
Thanks,
Matt
Hi matthewcanty
you can use fillnull on your search and you will get 0 for every empty field
... | fillnull
read more here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull
cheers, MuS
Try this:
earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | append [| search | fields - * | eval count=0] | timechart span=30m count
Hi matthewcanty
you can use fillnull on your search and you will get 0 for every empty field
... | fillnull
read more here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull
cheers, MuS
Greetings from the future,
you can run a search like this:
index=_internal
| stats count by sourcetype
| append
[| stats count
| eval sourcetype=if(isnull(sourcetype), "Nothing to see here, move along!", sourcetype)]
| streamstats count AS line_num
| eval head_num=if(line_num > 1, line_num - 1, 1) | where NOT ( count=0 AND head_num < line_num ) | table sourcetype count
cheers, MuS
Hmm it looks like this only works, if your search returns at least one event....
Yes, same thing is happening on my side. Fillnull is made for returning value for null attributes but the condition is to have at least a row of results. When there are no results at all, there is no fillnull working in that condition.
Doesn't work anyway guys.
out luck /K was not around, he would have answered this loooong before us 🙂
MuS you beat me to it.