Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to force all needed rows and columns to display in a chart, table or other, when sometimes no data is found.

$
0
0
Howdy, I'm struggling with the following and hoping you can help. To summarize, I require a 'value' column, which is the left most column that contains all the possible values I have defined in an eval statement. The values in this left most column are all the possible values that might be in the data. The other columns consist of all the possible status values that might be in the data. As an example Value Status1 Status2 Status3 Status4 Value1 Value2 Value3 Value4 Value5 All values and Status must be display, whether there is data in the index or not. For example, If I have this data. Value Status Value1 Status1 Value1 Status1 Value1 Status2 Value1 Status3 Value2 Status1 Value2 Status2 Value3 Status3 Value3 Status1 The the chart\table result should be as follows Value Status1 Status2 Status3 Status4 Value1 2 1 1 0 Value2 1 1 0 0 Value3 1 0 0 0 Value4 0 0 0 0 Value5 0 0 0 0 I've danced around this for a couple of days without any success. Looked up and tried all sorts of things without success. Any thoughts or help y'all might offer will be greatly appreciated. Thank you. PS: I'm really trying to not use joins in any way, so as to avoid the costs associated with it.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>