Splunk Search

Why does makeresults returns "1" instead of "0"?


My search:



| makeresults earliest=-2h
| timechart count as aantal span=1m



returns a list of zero's but for the last/current minute it returns "1". I only want zero's back to combine this search with a timechart.

After combining these searches (makeresults and timechart) there should be no message "no values found" anymore.

What do I have to change to have only zero's as a result of my makeresults search?

Labels (1)
0 Karma


makeresult creates an event with a timestamp (more is you use count=0).

timechart uses earliest (and latest) to aggregate over using span to determine the buckets.

Your latest count is 1 from the makeresults.

Try a different aggregation e.g. max() and then fillnull

| makeresults earliest=-2h
| timechart max(aantal) as aantal span=1m
| fillnull value=0 aantal


I have no clue what do you wanna achieve at the end 😄

But you could do it like

| makeresults earliest=-2h
| timechart count as aantal span=1m
| eval aantal=if(aantal=1,"0","0")
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...