Set zero value if there is nothing found in the search

[bosch_softtec]

Hi,

I'm running Splunk 6.6 and I like to set something like a "default" value in the case that there was nothing found with the SPL query.

The result I get is:

SystemA_primary       4000
SystemA_secondary      100
SystemB_secondary     3000

But I like to get something like this:

SystemA_primary       4000
SystemA_secondary      100
SystemB_primary          0
SystemB_secondary     3000
SystemX_primary          0
SystemX_secondary        0

I tried it with the following querry without success:

index=log 'gateway'
| rex field=source "\/\w+\/\w+\/log\/(?<Env>\w+)\/\w+\_(?<instance>\w+)\/.*"
| eval Inst= Env+"_" + instance
| stats count as connections by Inst
| makecontinuous source
| fillnull value=0 connections

Thanks for your tips and answers.

[HiroshiSatoh]

It can not be made unless the value exists.

SystemB、primary
SystemX、primary
SystemX、secondary

Is there a way to get these with LOOKUP etc?　Or search all.

Try this!

index=log "gateway" |stats count by source| fields - count
| rex field=source "\/\w+\/\w+\/log\/(?<Env>\w+)\/\w+\_(?<instance>\w+)\/.*"
| eval Inst= Env+"_" + instance
|join type=outer Inst
    [search  index=log "gateway" earliest=-24h@h
      | rex field=source "\/\w+\/\w+\/log\/(?<Env>\w+)\/\w+\_(?<instance>\w+)\/.*"
      | eval Inst= Env+"_" + instance
      | stats count as connections by Inst]
 | fillnull value=0 connections

※Conditions are different but this one is faster.
| tstats count where index=log by source

[bosch_softtec]

I've never used "lookup". With "search all" it should be possible to get alle source files.
Is it maybe possible to use it like seache all sources in the last 24h and set the connection value to "0" for each source and combine the result of lookup and my querry?