Splunk Search

command stats with full table even if null values

loyslegrand
Path Finder

Hi

Does anyone know how to get as output of a stats command a table with all values even when the result is null to avoid gaps in the table?

" ..... | stats count by date_mday Priority | xyseries date_mday Priority count | fillnull | sort+date_mday"

If there is no entry for one day , the day is skipped.

BRgds

Loys

Tags (1)
1 Solution

MuS
Legend

Hi loyslegrand,

take this run everywhere example and adapt it to your needs:

 index=_internal foo earliest=-30d | timechart span="1d" count | eval date_mday=strftime(_time, "%d") | fields count date_mday

Here the timechart does most of what you want but the date_mday is blank for dates with no data. The eval will recreate this field and finally the fields command cleans the result.

hope this helps to get you started ...

cheers, MuS

View solution in original post

HiroshiSatoh
Champion

Do not work taimechart?
..... | taimechart span=1d count by Priority

0 Karma

MuS
Legend

Hi loyslegrand,

take this run everywhere example and adapt it to your needs:

 index=_internal foo earliest=-30d | timechart span="1d" count | eval date_mday=strftime(_time, "%d") | fields count date_mday

Here the timechart does most of what you want but the date_mday is blank for dates with no data. The eval will recreate this field and finally the fields command cleans the result.

hope this helps to get you started ...

cheers, MuS

MuS
Legend

nice, please mark this as answered by ticking the tick - thx 🙂

0 Karma

loyslegrand
Path Finder

Thanks , it works; as I wanted the count by Priority I have entered :
"index=_internal foo earliest=-30d | timechart span="1d" count by Priority | eval date_mday=strftime(_time, "%d")"
the result is a full table including the null values

Loys

0 Karma

Ayn
Legend

Add fillnull before your stats command.

... | fillnull date_mday | stats count ...

loyslegrand
Path Finder

with fillnull, I have the same result as before
Thanks
Loys

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...