Splunk Search

how to show 0 when no search result found

cyberportnoc
Explorer

after succeed with

"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | where Infected=0 | stats sum(linecount) as resultofscan | eval typeofresult="totalofnotinfected" | table typeofresult, resultofscan

to show a summary

then when deal with 0 case

"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | where Infected>0 | stats sum(linecount) as resultofscan | eval totalofinfected=if(linecount=0,0,0)  | eval scanresult="totalofinfected" | table typeofresult, resultofscan

when infected > 0 , no search result found, it has problem

final should be like

typeofresult               resultofscan
totalofnotinfected     100
totalofinfected               0
total                             100


    "Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | where Infected=0 | stats sum(linecount) as resultofscan | eval typeofresult="totalofnotinfected" | table typeofresult, resultofscan
 | append [ |"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | where Infected>0 | stats sum(linecount) as resultofscan | eval totalofinfected=if(linecount=0,0,0)  | eval scanresult="totalofinfected" | table typeofresult, resultofscan ]

2.. as do not know how to sum the total after append table
then i hard code a total, but it can not append this hardcoded total to table

| append [ | eval resultofscan=36 | eval typeofresult="total" | table typeofresult, resultofscan ]

Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion

do you need the append?
can you do something like this:

"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") 
|eval typeofresult=case(Infected=0,"totalofnotinfected","totalofinfected")
| stats sum(linecount) as resultofscan by typeofresult
|appendpipe [stats count |eval typeofresult="totalofinfected"|where count==1|table typeofresult]
|fillnull resultofscan value=0
|addcoltotals resultofscan

View solution in original post

cmerriman
Super Champion

do you need the append?
can you do something like this:

"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") 
|eval typeofresult=case(Infected=0,"totalofnotinfected","totalofinfected")
| stats sum(linecount) as resultofscan by typeofresult
|appendpipe [stats count |eval typeofresult="totalofinfected"|where count==1|table typeofresult]
|fillnull resultofscan value=0
|addcoltotals resultofscan

cyberportnoc
Explorer

Error in 'eval' command: The arguments to the 'case' function are invalid.

if there is another method besides append, it can also use it

0 Karma

cyberportnoc
Explorer

succeed with
"Infected files:" | rex field=_raw "Infected files: (?\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | eval typeofresult=if(Infected=0,"totalofnotinfected","totalofinfected") | stats sum(linecount) as resultofscan by typeofresult | appendpipe [stats count |eval typeofresult="totalofinfected"|where count==1|table typeofresult]
| fillnull resultofscan value=0
| addcoltotals resultofscan

0 Karma

cyberportnoc
Explorer

i change case to if

0 Karma

cmerriman
Super Champion

oh sorry, my mistake 🙂

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...