Splunk Search

show empty table instead of no results found

jeroenborger
Explorer

hello splunk communitie, i am new to splunk but found allot of information allready but i have a problem with the given statement down below. in normal situations this search should not give a result. but then it shows as no results found and i want that is just shows 0 on all fields in the table. but when there are results it needs to show the results and not the 0.

i tried to do it with a eval if statement.
i tried it with the fillnull statement.

index=msad OR windows OR wineventlog host=%hostname% EventCode=4897 NOT (user="*$" OR user="-")

| dedup _time
| stats count,Values(Token_Elevation_Type) as "Token" by user Token_Elevation_Type
| table host,user,count,Token
| sort - count

greetings Jeroen

0 Karma
1 Solution

renjith_nair
Legend

@jeroenborger ,

try

| appendpipe [|stats count|where count=0]|fillnull value=0 host,user,Token

In b/w fields in your stats command and table command does not match. You might see null for those fields which are not part of your stats, for e.g. host.

index=msad OR windows OR wineventlog host=%hostname% EventCode=4897 NOT (user="*$" OR user="-") 
| dedup _time 
| stats count,Values(Token_Elevation_Type) as "Token" by user Token_Elevation_Type
| appendpipe [|stats count|where count=0]|fillnull value=0 Token,user,Token_Elevation_Type
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@jeroenborger ,

try

| appendpipe [|stats count|where count=0]|fillnull value=0 host,user,Token

In b/w fields in your stats command and table command does not match. You might see null for those fields which are not part of your stats, for e.g. host.

index=msad OR windows OR wineventlog host=%hostname% EventCode=4897 NOT (user="*$" OR user="-") 
| dedup _time 
| stats count,Values(Token_Elevation_Type) as "Token" by user Token_Elevation_Type
| appendpipe [|stats count|where count=0]|fillnull value=0 Token,user,Token_Elevation_Type
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

jeroenborger
Explorer

thanks your statement works like i want 🙂 thank you for the help!

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...