Set a default value for rows when they don't get a hit

[codetester]

So we have a query:

(index="it_ops")  source="bank_sys" message.content.country IN ("CANADA","USA","UK","FRANCE","SPAIN","IRELAND") message.content.code <= 399 | stats max(message.timestamp) as maxtime by message.content.country

Now this returns a two column result with country, maxtime. However, when there is no hit for country that country is omitted. I tried fillnull but it is only adding columns not rows.

 How do we set a default maxtime for countries that are not found.

[ITWhisperer]

Splunk is not good at finding something that isn't there - you need to help it!

| append
    [| makeresults
    | fields - _time
    | eval message.content.country=split("CANADA,USA,UK,FRANCE,SPAIN,IRELAND",",")
    | mvexpand message.content.country
    | eval maxtime=now()]
| stats min(maxtime) as maxtime by message.content.country