Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it. https://www.duanewaddle.com/proving-a-negative/ If the set of apps is small enough, you may be able to append a static set of zero counts and then add them to what Splunk produces. <<current query>> | append [ makeresults format=csv data="app_name,error_count app1,0 app2,0 app3,0 app4,0 app5,0"] | stats sum(error_count) as error_count by app_name

continue... Hi @ITWhisperer The query used to get the above three table format       1st query: index= source IN ("") "uniqObjectIds" OR "data retrieved for Ids" | eval PST=_time-28800 | eval PST_TIME=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath output=uniqObjectIds path=uniqObjectIds{} |where isnotnull(uniqObjectIds) | spath output=uniqueRetrievedIds path=uniqueRetrievedIds{}| stats values(*) as * by _raw | table uniqObjectIds,uniqObjectIdsCount,uniqObjectIds{},PST_TIME | sort- PST_TIME 2nd query" index= source IN ("") "data retrieved for Ids"| eval PST=_time-28800 | eval PST_TIME=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath output=uniqueRetrievedIds path=uniqueRetrievedIds{} |where isnotnull(uniqueRetrievedIds)| stats values(*) as * by _raw | table uniqueRetrievedIds{},uniqueRetrievedIds, PST_TIME | sort- PST_TIME 3rd query: index= source IN ("") "data not found for Ids"| eval PST=_time-28800 | eval PST_TIME=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath output=dataNotFoundIds path=dataNotFoundIds{}|where isnotnull(dataNotFoundIds) | stats values(*) as * by _raw | table dataNotFoundIds{},dataNotFoundIdsCount, PST_TIME | sort- PST_TIME       Could you help

Hi @ITWhisperer  Thank for your reply and suggestions.Really appreciate ! Now I have added a log in all the below  raw event which will have "entity":"suppliedMaterial"     {"name":"","awsRequestId":"","hostname":"","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","uniqObjectIds":["122598","268817","88888888888","99999999999999999","abc"],"uniqObjectIdsCount":5,"msg":"unique objectIds","time":"2023-11-09T13:56:36.559Z","v":0} 2nd event {"name":"","awsRequestId":"","hostname":"","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","uniqueRetrievedIds":[],"msg":"data retrieved for Ids","time":"2023-11-09T13:56:36.749Z","v":0} 3rd event {"name":"","awsRequestId":"","hostname":"","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","dataNotFoundIds":["122598","268817","88888888888","99999999999999999","abc"],"dataNotFoundIdsCount":5,"msg":"data not found for Ids","time":"2023-11-09T13:56:36.749Z","v":0}     Currently i have three query which fetch the result from _raw in below table format  Expected.I want all three different table combined and show their result   based on common key value entity: "suppliedMaterial" from raw events .   uniqObjectIds uniqObjectIdsCount uniqObjectIds{} PST_TIME 122598 268817 88888888888 99999999999999999 abc 5 122598 268817 88888888888 99999999999999999 abc 2023-08-11 06:38:01 122598 268817 88888888888 99999999999999999 abcdefg 5 122598 268817 88888888888 99999999999999999 abcdefg 2023-08-11 06:37:44 122598 268817 88888888888 99999999999999999 abcdefg 5 122598 268817 88888888888 99999999999999999 abcdefg 2023-08-11 06:35:40 122598 268817 88888888888 99999999999999999 abcdefg 5 122598 268817 88888888888 99999999999999999 abcdefg 2023-08-11 06:33:14 uniqueRetrievedIds{} uniqueRetrievedIds PST_TIME 122598 268817 122598 268817 2023-08-11 06:38:01 122598 268817 122598 268817 2023-08-11 06:37:44 122598 268817 122598 268817 2023-08-11 06:35:40 122598 268817 122598 268817 2023-08-11 06:33:14 122598 268817 122598 268817 2023-08-11 03:28:56 275649 275649 2023-06-11 06:49:10 275649 275649 2023-03-11 04:28:36 275649 275649 2023-03-11 03:13:07 108795 108795 2023-03-11 03:09:07 108795 275649 108795 275649 2023-02-11 14:44:04 dataNotFoundIds{} dataNotFoundIdsCount PST_TIME 88888888888 99999999999999999 abc 3 2023-08-11 06:38:01 88888888888 99999999999999999 abcdefg 3 2023-08-11 06:37:44 88888888888 99999999999999999 abcdefg 3 2023-08-11 06:35:40 88888888888 99999999999999999 abcdefg 3    

@richgalloway  thanks!  that might be working...  how do I include count of zero when there are no matches?  like, app_name  error_count app1              0 app2              0 app3              5 app4              0 app5              233

Have you tried setting a new field that defines the app and then grouping on that field? | eval appType = case(SourceName="Foo \"bar(\"", "app 1", SourceName="Foo \"quill(\"", "app 2", SourceName="Foo", "app 3", source=abcde, "app 4", sourcetype=windows AND eventcode=11111, "app 5", 1==1, "other") | stats count by appType

Again, the cs2 field can contain either a user name or a group name.  Users and groups have very similar naming conventions so I don't see how Splunk can correctly determine if a given cs2 value is a user or a group. Unless, that is, assumptions can be made about user or group names.  For example, if a group name always begins with "Secret Server". | eval group = if(match(cs2, "^Secret Server"), cs2, null()) | eval user = if(match(cs2, "^Secret Server"), null(), cs2)

USE_LOCAL_SYSTEM Install the universal forwarder as a local system 0   The default flag on install is 0 - update the install line to flag this set to 1. This is no longer best practice for security so be prepared to update future installs to fit with best practices.

Hi @richgalloway , The user naming convention look like firstname last name eg:  samuel raj , jhony walker etc. This should be in the user field and  group naming convention look like Secret Server Linux Server , Secret Server Windows Server etc. and this should be in the group fields, how we can achieve? Thanks..                                                                      

Have you checked out the free "Getting Data into Splunk" course at https://education-internal.splunk.com/Saba/Web_spf/NA10P2PRD105/guestapp/shared;spf-url=guest%2Fcategorydetail%2Fcateg000000000003041? You should be able to ingest the specified files by adding the following to an inputs.conf file on the appropriate server.  You will also need Splunk Enterprise or Splunk Universal Forwarder on the same server. [monitor:///app/docker/en*/logs] index = foo sourcetype = bar

Have you checked Splunkbase?  There is an app there (https://splunkbase.splunk.com/app/6096) that will send events to BMC Helix, but it doesn't say what BMC does with that event.  Perhaps your BMC contact can offer more information.