Splunk Search
Highlighted

fillnull not working

Motivator

I have a query
base query | stats count by ABC | fillnull

but i am getting "no result"

instead of this, i want to display ABC count as "zero"

Tags (1)
0 Karma
Highlighted

Re: fillnull not working

Champion

Can you share whole query? Is ABC field exist?

Highlighted

Re: fillnull not working

Motivator

yes..it exist..please consider ABC is name of error

0 Karma
Highlighted

Re: fillnull not working

Champion

can you try :

 | stats count AS abc_count by ABC | fillnull abc_count value=0
0 Karma
Highlighted

Re: fillnull not working

Motivator

still i am getting the same result

0 Karma
Highlighted

Re: fillnull not working

Champion
Highlighted

Re: fillnull not working

Motivator

yes..could you please modify and provide the query

0 Karma
Highlighted

Re: fillnull not working

Ultra Champion

I don't entirely follow what you're trying to achieve, but the purpose of fillnull is to populate empty fields with a null value, not to generate results when there are none. When the stats command returns 0 results, there is nothing to apply "fillnull" on.

If you can elaborate a bit more what you want to achieve (and if possible show some sample data and expected outcomes) we can try and help you find a solution that does work.

0 Karma
Highlighted

Re: fillnull not working

Motivator

stats command displaying "no result found" but i need value zero to be displayed

0 Karma
Highlighted

Re: fillnull not working

Motivator

Try this - from here: https://answers.splunk.com/answers/467823/if-there-are-no-results-found-how-do-i-get-my-sear.html

base query | stats count by ABC
 | appendpipe [ stats count | eval "NoResults"="0"  | where count=0 |table "NoResults"]

View solution in original post

0 Karma