Splunk Search

show empty table instead of no results found

jeroenborger
Explorer

hello splunk communitie, i am new to splunk but found allot of information allready but i have a problem with the given statement down below. in normal situations this search should not give a result. but then it shows as no results found and i want that is just shows 0 on all fields in the table. but when there are results it needs to show the results and not the 0.

i tried to do it with a eval if statement.
i tried it with the fillnull statement.

index=msad OR windows OR wineventlog host=%hostname% EventCode=4897 NOT (user="*$" OR user="-")

| dedup _time
| stats count,Values(Token_Elevation_Type) as "Token" by user Token_Elevation_Type
| table host,user,count,Token
| sort - count

greetings Jeroen

0 Karma
1 Solution

renjith_nair
Legend

@jeroenborger ,

try

| appendpipe [|stats count|where count=0]|fillnull value=0 host,user,Token

In b/w fields in your stats command and table command does not match. You might see null for those fields which are not part of your stats, for e.g. host.

index=msad OR windows OR wineventlog host=%hostname% EventCode=4897 NOT (user="*$" OR user="-") 
| dedup _time 
| stats count,Values(Token_Elevation_Type) as "Token" by user Token_Elevation_Type
| appendpipe [|stats count|where count=0]|fillnull value=0 Token,user,Token_Elevation_Type
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@jeroenborger ,

try

| appendpipe [|stats count|where count=0]|fillnull value=0 host,user,Token

In b/w fields in your stats command and table command does not match. You might see null for those fields which are not part of your stats, for e.g. host.

index=msad OR windows OR wineventlog host=%hostname% EventCode=4897 NOT (user="*$" OR user="-") 
| dedup _time 
| stats count,Values(Token_Elevation_Type) as "Token" by user Token_Elevation_Type
| appendpipe [|stats count|where count=0]|fillnull value=0 Token,user,Token_Elevation_Type
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

jeroenborger
Explorer

thanks your statement works like i want 🙂 thank you for the help!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...