Splunk Search

how to display only those rows which have the fillnull values

vrmandadi
Builder

alt text
index=abc |chart sum(" Views") by "Site" ,"Event Date" | fillnull value=0

how can I display only those rows which have the fillnull value

0 Karma

somesoni2
Revered Legend

Give this a try

index=abc |chart sum("Views") by "Site_Section" ,"Event Date" | fillnull value=0
| eval hasZero="No" | foreach * [| eval hasZero=if("<<MATCHSTR>>"!="Site_Section" AND '<<FIELD>>'=0,"Yes",hasZero) ]
| where hasZero="Yes" | fields - hasZero

niketn
Legend

@vrmandadi, do you need the rows which have all 0s or at-least one zero for various "Event Date"?

Also if possible what is the format of "Event Date"? Can you add some sample data output for above query?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vrmandadi
Builder

I just added an image ,and yes I need all the rows with 0s

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...