Getting Data In

How to display fields in a table panel even if the result field = 0?

jip31
Motivator

hello

In a panel table, I need to display every sourcetype results even if the sourcetype result = 0
I have done an if condition but it doenst works
could you help me please?

`windows` sourcetype="Win" OR sourcetype=report OR sourcetype=abdm OR sourcetype=app OR sourcetype="flags" OR sourcetype="up" 
| stats dc(host) as "Number of hosts" by sourcetype 
| sort -"Number of hosts"
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jip31

Can you please try this?

 `windows` sourcetype="Win" OR sourcetype=report OR sourcetype=abdm OR sourcetype=app OR sourcetype="flags" OR sourcetype="up" 
| stats dc(host) as count by sourcetype 
| sort -"Number of hosts" | append [| makeresults 
| eval sourcetype="Win||report||abdm||app||flags||up",sourcetype=split(sourcetype,"||"), count=0
| mvexpand sourcetype 
| table sourcetype count ]  | stats sum(count) as "Number of hosts" by sourcetype

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jip31

Can you please try this?

 `windows` sourcetype="Win" OR sourcetype=report OR sourcetype=abdm OR sourcetype=app OR sourcetype="flags" OR sourcetype="up" 
| stats dc(host) as count by sourcetype 
| sort -"Number of hosts" | append [| makeresults 
| eval sourcetype="Win||report||abdm||app||flags||up",sourcetype=split(sourcetype,"||"), count=0
| mvexpand sourcetype 
| table sourcetype count ]  | stats sum(count) as "Number of hosts" by sourcetype
0 Karma

jip31
Motivator

many thanks!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...