hello splunk communitie, i am new to splunk but found allot of information allready but i have a problem with the given statement down below. in normal situations this search should not give a result. but then it shows as no results found and i want that is just shows 0 on all fields in the table. but when there are results it needs to show the results and not the 0.
i tried to do it with a eval if statement.
i tried it with the fillnull statement.
index=msad OR windows OR wineventlog host=%hostname% EventCode=4897 NOT (user="*$" OR user="-")
| dedup _time
| stats count,Values(Token_Elevation_Type) as "Token" by user Token_Elevation_Type
| table host,user,count,Token
| sort - count
greetings Jeroen
@jeroenborger ,
try
| appendpipe [|stats count|where count=0]|fillnull value=0 host,user,Token
In b/w fields in your stats command and table command does not match. You might see null for those fields which are not part of your stats, for e.g. host
.
index=msad OR windows OR wineventlog host=%hostname% EventCode=4897 NOT (user="*$" OR user="-")
| dedup _time
| stats count,Values(Token_Elevation_Type) as "Token" by user Token_Elevation_Type
| appendpipe [|stats count|where count=0]|fillnull value=0 Token,user,Token_Elevation_Type
@jeroenborger ,
try
| appendpipe [|stats count|where count=0]|fillnull value=0 host,user,Token
In b/w fields in your stats command and table command does not match. You might see null for those fields which are not part of your stats, for e.g. host
.
index=msad OR windows OR wineventlog host=%hostname% EventCode=4897 NOT (user="*$" OR user="-")
| dedup _time
| stats count,Values(Token_Elevation_Type) as "Token" by user Token_Elevation_Type
| appendpipe [|stats count|where count=0]|fillnull value=0 Token,user,Token_Elevation_Type
thanks your statement works like i want 🙂 thank you for the help!