Splunk Search

how to show 0 when no search result found

cyberportnoc
Explorer

after succeed with

"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | where Infected=0 | stats sum(linecount) as resultofscan | eval typeofresult="totalofnotinfected" | table typeofresult, resultofscan

to show a summary

then when deal with 0 case

"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | where Infected>0 | stats sum(linecount) as resultofscan | eval totalofinfected=if(linecount=0,0,0)  | eval scanresult="totalofinfected" | table typeofresult, resultofscan

when infected > 0 , no search result found, it has problem

final should be like

typeofresult               resultofscan
totalofnotinfected     100
totalofinfected               0
total                             100


    "Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | where Infected=0 | stats sum(linecount) as resultofscan | eval typeofresult="totalofnotinfected" | table typeofresult, resultofscan
 | append [ |"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | where Infected>0 | stats sum(linecount) as resultofscan | eval totalofinfected=if(linecount=0,0,0)  | eval scanresult="totalofinfected" | table typeofresult, resultofscan ]

2.. as do not know how to sum the total after append table
then i hard code a total, but it can not append this hardcoded total to table

| append [ | eval resultofscan=36 | eval typeofresult="total" | table typeofresult, resultofscan ]

Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion

do you need the append?
can you do something like this:

"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") 
|eval typeofresult=case(Infected=0,"totalofnotinfected","totalofinfected")
| stats sum(linecount) as resultofscan by typeofresult
|appendpipe [stats count |eval typeofresult="totalofinfected"|where count==1|table typeofresult]
|fillnull resultofscan value=0
|addcoltotals resultofscan

View solution in original post

cmerriman
Super Champion

do you need the append?
can you do something like this:

"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") 
|eval typeofresult=case(Infected=0,"totalofnotinfected","totalofinfected")
| stats sum(linecount) as resultofscan by typeofresult
|appendpipe [stats count |eval typeofresult="totalofinfected"|where count==1|table typeofresult]
|fillnull resultofscan value=0
|addcoltotals resultofscan

cyberportnoc
Explorer

Error in 'eval' command: The arguments to the 'case' function are invalid.

if there is another method besides append, it can also use it

0 Karma

cyberportnoc
Explorer

succeed with
"Infected files:" | rex field=_raw "Infected files: (?\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | eval typeofresult=if(Infected=0,"totalofnotinfected","totalofinfected") | stats sum(linecount) as resultofscan by typeofresult | appendpipe [stats count |eval typeofresult="totalofinfected"|where count==1|table typeofresult]
| fillnull resultofscan value=0
| addcoltotals resultofscan

0 Karma

cyberportnoc
Explorer

i change case to if

0 Karma

cmerriman
Super Champion

oh sorry, my mistake :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...