Hi All,
I have situation where I want to show a message instead of empty cell.
I am using below query to get some data:
somesearch | rex field=msg "ErrorCode\\":(?\d+)"
| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by cf_app_name, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status + " (" + noOfInstances +")"
| table cf_app_name, Core,Status
| eval {Core}=Status
| fields - Core, Status
| stats values() as * by cf_app_name
and getting results in as shown in below image
here for some of the components I don't have any events in splunk. So I want to show it as down. how can I achieve this ?
Thank in advance.
Try ... | fillnull value="DOWN"
.
Try ... | fillnull value="DOWN"
.
Thank you very much.