Splunk Search

user with no activity

gnshah12345
Observer

We are monitoring the user activities for a day. The query is as follows.

remote_user=a OR remote_user=b OR remote_user=c index=my_index earliest=@d+450m latest=@d+18h |timechart count as "User Name" by remote_user.

The issue is if a user does not have activity than report is not showing that. We want the report to include the user with 0 activity. Is there a way to force that into search?

Tags (1)
0 Karma

gnshah12345
Observer

This works partially. I am getting the remote_users as a column in my table. However, the user, who does not have the activity is showing blank row instead 0. How can I force 0 when there is no activity?

0 Karma

adonio
Ultra Champion

try something like this:

remote_user=a OR remote_user=b OR remote_user=c index=my_index earliest=@d+450m latest=@d+18h 
|timechart count as "User Name" by remote_user 
| table _time a b c 
| fillnull value=0

hope it helps

0 Karma

gnshah12345
Observer

The result works partially. I am getting users as the column headers. However, the row is empty for user, who has no activity at all. The desirable result is to have 0 instead of blank.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...