Splunk Search

Showing 0 instead of no results, how to get this line to append to another lookup?

fereze
Engager

Hi Everyone: I have this query on which is comparing the file from last week to the one of this one. I'm doing this to bring new events by date, but when there is no results found it is no showing me the Date and a 0, and I need this line to append it to another lookup.

| inputlookup append=t NEW.csv
| lookup OLD.csv UniqueID OUTPUTNEW UniqueID as NEW
| where like(ISSUE,"%Wrong%")
| where isnull(NEW)
| stats count as New_event by DATE_REPORT
| eval Date=strftime(strptime(DATE_REPORT, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y")
| fields Date New_event

 

 

I would like to get something like this:

Date                           New_event
6-23-2022               0

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use the appendpipe command to detect the absence of results and insert "dummy" results for you.

| inputlookup append=t NEW.csv
| lookup OLD.csv UniqueID OUTPUTNEW UniqueID as NEW
| where like(ISSUE,"%Wrong%")
| where isnull(NEW)
| stats count as New_event by DATE_REPORT
| eval Date=strftime(strptime(DATE_REPORT, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y")
| appendpipe [ stats count | eval DATE_REPORT=strftime(now(), "%m-%d-%Y") | eval New_event=0 | where count=0 | fields - count ]
| fields Date New_event

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use the appendpipe command to detect the absence of results and insert "dummy" results for you.

| inputlookup append=t NEW.csv
| lookup OLD.csv UniqueID OUTPUTNEW UniqueID as NEW
| where like(ISSUE,"%Wrong%")
| where isnull(NEW)
| stats count as New_event by DATE_REPORT
| eval Date=strftime(strptime(DATE_REPORT, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y")
| appendpipe [ stats count | eval DATE_REPORT=strftime(now(), "%m-%d-%Y") | eval New_event=0 | where count=0 | fields - count ]
| fields Date New_event

 

---
If this reply helps you, Karma would be appreciated.

fereze
Engager

It works! Thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...