Splunk Search

Show count 0 on tstats with index name for multiple indexes

mkarimi17
Path Finder

I have a search:

| tstats count WHERE earliest=-2d@-3h latest=now index=* by index, _time | makecontinuous span=1h _time | eval count=if(isnull(count),0,count)

where the count is shown as 0 if there is no data, however I get an empty field for the index at that specific time. How can I search for every hour and every index and if index Y does not have any count to show:

index _time &nbsp count
Y 2017-09-03 00:00 0

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

| tstats count WHERE earliest=-2d@-3h latest=now index=* by index, _time span=1h | timechart sum(count) as count by index limit=0 | fillnull value=0 | untable _time index count

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try

| tstats count WHERE earliest=-2d@-3h latest=now index=* by index, _time span=1h | timechart sum(count) as count by index limit=0 | fillnull value=0 | untable _time index count

mkarimi17
Path Finder

thanks! that actually works but any idea why if I go back more than 4 days I lose the hour portion of the _time?

| tstats count WHERE earliest=-5d@-3h latest=now index=* by index, _time span=1h | timechart sum(count) as count by index limit=0 | fillnull value=0 | untable _time index count

when I do that, time only shows the dates. Realistically I am going back -30 days

0 Karma

somesoni2
SplunkTrust
SplunkTrust

My bad. I didn't set the span in timechart command so it was doing auto span based on number of points (which will be higher with longer timerange), try this version

| tstats count WHERE earliest=-5d@-3h latest=now index=* by index, _time span=1h | timechart span=1h sum(count) as count by index limit=0 | fillnull value=0 | untable _time index count

mkarimi17
Path Finder

Perfect! thank you

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...