Great to see you arrived at a solution that works for you. Please mark this answer as solved in case it is useful for other Splunk community members. ... View more

Hi @kaeleyt  Interested to know if this helped solve your problem?  ... View more

Hi @kaeleyt  The following will account for no results.  The first append section ensures a dummy row with date column headers based of the time picker (span=1).  This is ensure a result set no matter what you base searches do.  It does expect the date columns to have the same date format, but you could adjust as needed. ... your base searches ... | append [ | makeresults | addinfo | eval min_max_time=mvappend(info_min_time, info_max_time) | mvexpand min_max_time | streamstats count | eval _time=if(count=1, info_min_time, info_max_time) | makecontinuous _time span=1d | where isnull(count) | eval Time= strftime(_time, "%m-%d-%y") | table column Time count | fillnull column value="dummy" | fillnull count value=0 | xyseries column Time count ] | append [ | makeresults | eval column=split("Row 1|Row 2|Row 3|Row 4", "|") | mvexpand column | table column ] | stats values(*) AS * BY column | fillnull value=0 | search column="Row*" The second append is as before and ensures the rows are created etc. You may want to make this a macro if it works. Hopefully, this suits your use case better now. ... View more

Hi @kaeleyt  The question you asked was... Does anybody have a good way to create a timechart table of all 0's for searches that return "No results found"? The solution I provided does show an example way to solve this problem, based on your examples.  However, your reply indicates that it does work, but then you say it due to needing to hard code the dates.  So maybe there is some confusion with my answer, or your question has not been clear enough.   This is the provided solution. | append [ |makeresults | eval column=split("Row 1|Row 2|Row 3|Row 4", "|") | mvexpand column | table column ] | stats values(*) AS * BY column | fillnull value=0 It does not care what the date columns and only hard codes the first row values (based on the example).  But, I agree, the solution does expect that the initial base search(es) did return at least one result.   So, is this the problem?  At times,  all your base searches return no results and hence the solution does not work?  There is probably a way to fix this too, if that is the case, but you need to be clear with what is required.   , what they are named or how many, but it does expect that the initial base search does find some results.     ... View more

Hi @mbasharat  I believe you're asking for a regex to just extract the compliance-check-id for the event.  Is this correct?   There are a few ways to do this but if you just want that one field then this will work for you. ... | rex "id>(?<complianceCheckID>[a-fA-F0-9]+)\<" ... Hope it helps. ... View more

Hi @kaeleyt  Append the following to the end of your search query ...   | append [ |makeresults | eval column=split("Row 1|Row 2|Row 3|Row 4", "|") | mvexpand column | table column ] | stats values(*) AS * BY column | fillnull value=0   Here's a run anywhere example with some dummy data which should help demonstrate how it works ...   | makeresults | eval column=split("Row 1|Row 2|Row 4", "|") | mvexpand column | eval date1=48, date2=0, date3=99 | table column date* `comment("# append this to the end of your search query")` | append [ |makeresults | eval column=split("Row 1|Row 2|Row 3|Row 4", "|") | mvexpand column | table column ] | stats values(*) AS * BY column | fillnull value=0    Hope it helps.  Please mark post as answered, if it does. ... View more

Hi @gauravmsharma  I think you need to read up on what a sourcetype is in Splunk and how it is used and should be used.  It will not help you here and is confusing when used in the context of this question. So for your question So the query remains can be use this initializing line for creating a sourcetype and assign logs to the same sourcetype till it recived a message Killed in the events. The answer is no. From what I can tell you are trying to tie individual events in a log file together, but these individual events have no unique key value to tie then together. Depending on the log content and the order of events in the log, you may be able to tie the individual events together using the Splunk processing language (SPL) with commands like transaction and stats.   Without a good look at the source log data it hard to know though.  If you attach some to this question then may be able to help.     ... View more

Hi @gauravmsharma  I'm not exactly sure what you're asking for here but I'll give an answer a go.  At least it might lead to some better understanding. I don't believe "dynamic sourcetype extraction based on the stanza" entry is something that can be done, or even should be done, if it was even possible in Splunk. The  sourcetype  determines how Splunk software processes the incoming data stream into individual events according to the nature of the data (ref:  https://docs.splunk.com/Documentation/Splunk/latest/Data/Aboutdefaultfields#Source_vs_sourcetype).  It a useful way of grouping similar data sources based on their data format/syntax/structure.   If you could do this then you would also, potentially, have to configure lots of sourcetype entries to tell Splunk how to process the incoming data into events . It does not really matter anyway as you also have the source metadata field, which already contains the function-name (as you call it) in the monitor stanza.  You can extract/manipulate it for every event when you search it. For example     # inputs.conf [monitor:///var/log/test-function_name.log] sourcetype = some_sourcetype     Events found in this file would all be assigned with source="/var/log/test-function_name.log" Now you can use regex or eval functions in the Splunk search language to extract the function_name from the source field's value, e.g.     ... my base search ... | rex field=source "\/(?<func_name>)[^\.]+)" ...     Resulting in all events in the inputs file having a new key value pair of func_name="test-function_name" .  This could also be automated in Splunk's  field extractions so it just happens automatically without specifying it in the search query, Note, I'm just using examples above to show what could be done and you will need to adjust for your own needs. Hope this helps or gives you some ideas.   ... View more

Good point about the search   "Errorcode=*"  @bowesmana, unless a "null" string is actually the output value in ErrorCode column.  @irishmanjb, that will change the query I provided.  The eval may need updating depending on the source data. ... View more