Splunk Search

Splunk display a value when no logs are found

Dayalss
Engager

Hi ,

I have a field which has 3 values i.e., 0 , 1 & 2.

0 for Green , 1 for Blue and 2 for Red. I'm using this values to show colour differences in dashboard.

But the search fetches data only at a particular time in a day , so the remaining time there is no data.

When there is no data , the dashboard is not loading. 

I want to indicate no data with black colour in the dashboard.

How can I do that? where in if there is no day I can create and map a field value in dashboard

Labels (1)
0 Karma

Dayalss
Engager

Its not working , because I'm tracking the field Status for colour change using below query

index = xyz sourcetype =abc
|eval Status =if(Statistic=0,"Green" , if(Statistic=2 ,"Red",if(Statistic=1,"Blue", " " )))
|stats latest(Status)

 

Can you please suggest according to above query?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I suspect you were too literal in applying my answer.  Try this

index = xyz sourcetype =abc
| eval Status=case(Statistic=0,"Green" , 
                   Statistic=2,"Red",
                   Statistic=1,"Blue", 
                   1==1, " " )
| appendpipe [ stats count | eval Status="Black" | where count=0 | fields - count]
| stats latest(Status)
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the appendpipe command to add values when none are returned by your query.

<<your search>>
| appendpipe [ stats count | eval colour="black" | where count = 0 | fields - count]

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...