Hi i encounter an issues when i try to display field in table form without any values my data look like table below:
ID Values
MAIN1 1.5
MAIN2
MAIN3
MAIN4 4.3
This is my search string:
Label="MIDPM" Order=2 |stats latest(Value) as Value by ID| eval Value=round(Value,2)| eval Value=if(isnull(VALUE),0,Value)| rename ID as Label
The result i get was display Main1 and Main4 only. I fail to replace those fields as zero. Mind to how should i resolve this issues?
Try adding this:
... | eval Value=if(isnum(Value),Value,0)
I just tried it out it only show me the result with MAIN1 AND MAIN4
You need to decide what the name of your "value" field is: is it VALUE
, Value
, or Values
(you use each of this in different spots). Once you use the SAME NAME CONSISTENTLY, then this answer will work.
is Value i tried this as well
if(isnull($result.MAIN2$),0.00,$result.MAIN2$)
it didn't working
i not sure isn't possible due Splunk 6.4 didn't compatible with "fillnull" feature
Add this:
... | fillnull value="0" Value
it didn't work the value is no null or empty that why "fillnull" no working
You need to decide what the name of your "value" field is: is it VALUE
, Value
, or Values
(you use each of this in different spots). Once you use the SAME NAME CONSISTENTLY, then this answer will work.
Hi qygoh,
have VALUE in uppercase is an error in your answer or is really uppercase?
because you should use
| eval Value=if(isnull(Value),0,Value)
Bye.
Giuseppe
hi my value is in lower case. sorry for the typo. But it still no working due to no result found. It didn't show as null or empty.