Splunk Search

Search to show zero when no results

matthewcanty
Communicator

I have the following search:

earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | timechart span=30m count

At the moment there are no results. And I get the "No results..." message.
But I want to see a 0 for every 30-minute timespan between 1100 and 2200.
How do I do this?

If there was a single result I get the full table- but if there were results then an alert would not trigger.

Thanks,
Matt

Tags (3)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi matthewcanty

you can use fillnull on your search and you will get 0 for every empty field

... | fillnull

read more here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull

cheers, MuS

View solution in original post

splunk_kk
Path Finder

Try this:

earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | append [| search | fields - * | eval count=0] | timechart span=30m count

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi matthewcanty

you can use fillnull on your search and you will get 0 for every empty field

... | fillnull

read more here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull

cheers, MuS

MuS
SplunkTrust
SplunkTrust

Greetings from the future,

you can run a search like this:

index=_internal 
| stats count by sourcetype 
| append 
    [| stats count 
    | eval sourcetype=if(isnull(sourcetype), "Nothing to see here, move along!", sourcetype)] 
| streamstats count AS line_num 
| eval head_num=if(line_num > 1, line_num - 1, 1) | where NOT ( count=0 AND head_num < line_num ) | table sourcetype count

cheers, MuS

MuS
SplunkTrust
SplunkTrust

Hmm it looks like this only works, if your search returns at least one event....

harry2007gsp
Path Finder

Yes, same thing is happening on my side. Fillnull is made for returning value for null attributes but the condition is to have at least a row of results. When there are no results at all, there is no fillnull working in that condition.

0 Karma

matthewcanty
Communicator

Doesn't work anyway guys.

0 Karma

MuS
SplunkTrust
SplunkTrust

out luck /K was not around, he would have answered this loooong before us 🙂

sdaniels
Splunk Employee
Splunk Employee

MuS you beat me to it.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...