Hi All
Below is my query to tabulate a few fields together and count them on basis of its value .I need help with a situation when there is no data available at all , in the current setup , this table wont come up if there is no data coming from source , it generates only when data is coming in index. Using apendpipe i am trying to show 0's everywhere and generate this table in case of no data from backend .Currently it fills up 0's in the missing empty field when there is some data. I am trying to handle a situation when there is no data , i dont want to use makeresults as the interpretation needed is no data means "No issue" from backend and hence showing 0's as no issues found, only when is there is an issue ,the numbers populate in the table.
We dont want to show blank hence filling up with 0's and showing the table is the requirement.Please help with rectification.
search (metric_label="*** Resource Health : Service Issue" OR metric_label="***Service Health : Service Issue") AND metric_value IN (300, 500)
| eval Service = mvindex(split(source_host," : "),1), Region = mvindex(split(source_host," : "),2)
| table metric_value Region Service Resources
| stats distinct_count(Region) as Region distinct_count(Service) as Service distinct_count(Resources) as Resources by metric_value
| eval Impact = case(metric_value=100,"Info",metric_value=200,"NA",metric_value=300,"Warning",metric_value=500,"Critical")
| fields - metric_value
| transpose column_name="Status" header_field=Impact
| appendpipe [
| table Region Service Resources
| eval Region=0
| eval Service=0 |eval Resources=0
| stats last(Region) AS Region , last(Service) as Service
| fillnull value="0" Region Service Resources
]
| eval OverallHealth = case(Critical>0,"CRITICAL",Warning>0,"WARNING",Warning=0 AND Critical=0,"HEALTHY") | Table Status,OverallHealth,Warning,Critical
the result is as follows at the moment ,
