Splunk Search

How to fill the null values in search results

jgcsco
Path Finder

How can I fill null value in the following result with desired value, e.g. 0:

mysearch | stats count by host

I would like to have the following result format

host1 xx
host2 0 (which has the null result from the search)
host3 yy
host4 zz
host5 0 (which has the null result from the search)

Any suggestions? Please help.

Thanks

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Based on your clarification, you need this:

index=* OR index=_* | stats count(eval(like(lower(_raw), "%error%"))) AS Errors by host

View solution in original post

woodcock
Esteemed Legend

Based on your clarification, you need this:

index=* OR index=_* | stats count(eval(like(lower(_raw), "%error%"))) AS Errors by host

jgcsco
Path Finder

Thanks woodcock. The only issue is that the log on each host is fairly large in terms of size, and the search here seem a bit inefficient, but it does provide the result I am looking for.

0 Karma

woodcock
Esteemed Legend

The most time spent is in the lower command so this should be faster:

 index=* OR index=_* | stats count(eval(match(_raw, "[eE][rR][rR][oO][rR]"))) AS Errors by host
0 Karma

jgcsco
Path Finder

Thanks for your quick response, I would like to include the null results and fill then with 0. Following is the search string:

host=* "Error" |stats count by host

Basically, I am search the log file on all the hosts to find out error messages, for the host that does not have any error, I would like to set the value with "0".

Thanks,

0 Karma

woodcock
Esteemed Legend

Generally you just add this:

... | fillnull value=0

But it is hard to say because your question does not include your search and data examples.

skoelpin
SplunkTrust
SplunkTrust

Do you want to exclude the null results from your search or fill them with 0? If the former then try isnotnull()

Provide your search and clarification and I can help you out

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...