Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Count does not shown as 0 when the username is not found in the sourcetype

$
0
0
Hi, I want to shown the Total as 0 if username in lookup table has not event log . Using the fillnull value , it does not shown the results. index=main sourcetype=oracle_ ACTION_NAME=LOGON [inputlookup testconn|fields username]|stats count AS Total by user |fillnull value=NULL How to go changing it ? Would appreciate any advise.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>