Splunk Search

if .csv file is empty how to get correct result in search

Mike6960
Path Finder

For one of my dashboards I am working with .csv files which are generated every day. these contain certain failures from different processes. When those are solved they will not appear the next day. So, if there are no failures at any one day the file will be empty. Splunk cannot index files which contain only headers.
I want to show a single value withe trendline to show the increase/decrease of failures. I f the file is empty the search shows the number of the last day where there were failures. How can i solve this?

Tags (1)
0 Karma

MuS
Legend

Hi Mike6960,

read this answer https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html to learn how you can handle empty search results.

Update:

take a look at this run everywhere example, yes it uses makeresults but only to create fake events :winking_face:

| makeresults `comment("Let build some fake events ...")`
| eval _raw="company,tesco|count,100|count,200|count,0|count,300" 
| extract pairdelim="|", kvdelim=",", mv_add=true, limit=0 
| mvexpand count 
| table _time company count `comment("This is where the fun starts ...")`
| streamstats current=f last(count) AS l_count by company 
| eval show_on_no_results=case(count="0", l_count,count!="0", null())

The important SPL command is the streamstats which will take the last known number and then you can use this last number and display it when the actual result is 0 :winking_face:

Hope this helps ...

cheers, MuS

0 Karma

Mike6960
Path Finder

@MuS, thanks for your response. Not really what I am looking for I think. Or maybe I don't understand the answer, I guess I have to look for something like makeresults or something

0 Karma

MuS
Legend

Hi Mike6960, sure you can use the answer as staring point. Just hold some minutes and I will be back with an example :winking_face:

0 Karma

MuS
Legend

Update ping ...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...