Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

How to modify the retrun value of stats count by search using eval

$
0
0

I am running a search query like this

index=w3c host=web-a OR host=web-b ASP_NET_SessionId=* c_ip=x.x.x.* | eval cur=if(_time>relative_time(now(),"-15m"),1,0) | stats dc(ASP_NET_SessionId) by cur | sort -cur

the return value of the above search sometimes return both values and sometime only one.

i.e.

Cur    dc(ASP_NET_SessionId)
1            15
0             2

And sometimes I may get,

Cur    dc(ASP_NET_SessionId)
1            12

And sometimes I may get, "No results found"

I suspect that I am not seeing the 2nd row (or No results found) here most likely because of the fact that the return value of dc(ASP_NET_SessionId) may be 0.

My question is, is there a way to modify the search so that I always get two rows even if the value is zero. I just want to display as zero and not a missing line or "No results found". So it should look like

 Cur    dc(ASP_NET_SessionId)
    1            0
    0            0

Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>