Splunk Search

How to get the 0 data rows using tstats query?

Vani_26
Path Finder

Original query:

 

index=app-data  sourcetype=clientapp-code
|rex field=_raw "\Status\:(?<Code>.*?)\|"
|eval Failed=if(Code!=0, "Failed", null())
|bucket _time span=1d
|stats count(Failed) as Fail by _time 

 



OUTPUT:

_time Fail
2022-01-22 6
2022-01-23 0
2022-01-24 8
2022-01-25 0
2022-01-26 0
2022-01-27 12
2022-01-28 0
2022-01-29 0



tstats query:

 

|tstats count where  index=app-data  sourcetype=clientapp-code by PREFIX(status:) _time span=1d
|rename status: as Code
|eval Failed=if(Code!=0, "Failed", null())
|where Code!=0
|stats values(count) by _time

 



OUTPUT:

_time Fail
2022-01-22 6
2022-01-24 8
2022-01-27 12

 

I want to see original query  output  with tstats query but 0 data rows are not showing up in tstats command.
How can i get the 0 data rows using tstats query???

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you try this makecontinuous?

r. Ismo

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Vani_26 - You forget to do | bucket in your second query.

Try adding either bucket or bin command before stats, similar to your first query.

 

OR alternatively, you can use timechart command instead of the stats command.

| timechart span=1d sum(count) as Fail

 

I hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...