Show an output message, when there were no logs in Splunk while using STATS by

[rkmaggidi]

Hi All,

I want to show a message even when there were no results returned in Splunk. While using stats by command.

Below is my query:

somesearch | rex field=msg "ErrorCode\\":(?\d+)"
| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by component, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status + " (" + noOfInstances +")"
| table component, Core,Status
| eval {Core}=Status
| fields - Core, Status
| stats values() as * by component

and getting results in as shown in below image

If any of the component is not having logs in Splunk, then it is being ignored from the result set. how should I make sure to include all the components even if there were no logs for them.

Thank you 🙂

[to4kawa · Accepted solution]

component.csv:

component
componentA
componentB
....

your query:

 somesearch 
| rex field=msg "ErrorCode\\\":(?<StatusCode>\d+)"
| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by component, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status." (".noOfInstances.")"
| table component, Core,Status
| eval {Core}=Status
| fields - Core, Status
| inputlookup append=t component.csv
| stats values(*) as * by component

[rkmaggidi]

Thank you so much. It worked. Can we do this in other way by not using lookups ?

[to4kawa]

....
| fields - Core, Status
| append[| makeresults
| eval component=split("componentA#componentBcomponentC","#")
| mvexpand component
|table component]
 | stats values(*) as * by component

If there is many components, csv is better.

[rkmaggidi]

Ok great. Thank you very much 🙂