Splunk Search

Show a message even when no events are returned using Sttats with by clause

rkmaggidi
New Member

Hi All,

I have situation where I want to show a message instead of empty cell.

I am using below query to get some data:

somesearch | rex field=msg "ErrorCode\\":(?\d+)"

| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by cf_app_name, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status + " (" + noOfInstances +")"
| table cf_app_name, Core,Status
| eval {Core}=Status
| fields - Core, Status
| stats values(
) as * by cf_app_name

and getting results in as shown in below image

here for some of the components I don't have any events in splunk. So I want to show it as down. how can I achieve this ?

Thank in advance.

alt text

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try ... | fillnull value="DOWN".

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try ... | fillnull value="DOWN".

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

rkmaggidi
New Member

Thank you very much.

0 Karma