if .csv file is empty how to get correct result in search

[Mike6960]

For one of my dashboards I am working with .csv files which are generated every day. these contain certain failures from different processes. When those are solved they will not appear the next day. So, if there are no failures at any one day the file will be empty. Splunk cannot index files which contain only headers.
I want to show a single value withe trendline to show the increase/decrease of failures. I f the file is empty the search shows the number of the last day where there were failures. How can i solve this?

[MuS]

Hi Mike6960,

read this answer https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html to learn how you can handle empty search results.

Update:

take a look at this run everywhere example, yes it uses makeresults but only to create fake events 😉

| makeresults `comment("Let build some fake events ...")`
| eval _raw="company,tesco|count,100|count,200|count,0|count,300" 
| extract pairdelim="|", kvdelim=",", mv_add=true, limit=0 
| mvexpand count 
| table _time company count `comment("This is where the fun starts ...")`
| streamstats current=f last(count) AS l_count by company 
| eval show_on_no_results=case(count="0", l_count,count!="0", null())

The important SPL command is the streamstats which will take the last known number and then you can use this last number and display it when the actual result is 0 😉

Hope this helps ...

cheers, MuS

[Mike6960]

@MuS, thanks for your response. Not really what I am looking for I think. Or maybe I don't understand the answer, I guess I have to look for something like makeresults or something

[MuS]

Hi Mike6960, sure you can use the answer as staring point. Just hold some minutes and I will be back with an example 😉

[MuS]

Update ping ...