Splunk Search

Splunk subsearch noresult

pdash
Path Finder

Am trying to run a query where subsearch might return no results on some days. In such case i am trying to assign 0 values to calculate ratio, but its not returning any results.

index=main sourcetype="abc" 
| eval date=strftime(_time, "%x") 
| stats dc(uuid) as countA by date   
| join _time  [ search index=main sourcetype="abc" | eval date=strftime(_time, "%x") | search "error" | stats dc(uuid) as countB by date]
| eval Ratio=(countA/(countA+countB)) 

I have tried appending fillnull at the end of subsearch but it returns noresults.

Tags (1)
0 Karma

pdash
Path Finder

got it:

index=main sourcetype="abc"
| eval date=strftime(_time, "%x")
| stats dc(uuid) as countA by date

| join _time [ search index=main sourcetype="abc" | eval date=strftime(_time, "%x") | search "error" | stats dc(uuid) as countB by date | appendpipe [ stats count | eval countB=0 | where count==0 | fields - count ] ]
| eval Ratio=(countA/(countA+countB))

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...