My search :
index=test
| where Value>=95
| stats count(Value) as Events by Host
The result :
Try replacing the 'where' with an eval in your stats command:
index=test
| stats count(eval(Value>=95)) AS Events by Host
That should result in either a count of your events that have the field Value >= 95 or 0 if no events meet that criteria.
Generally, try to limit the data you search over as early as possible. In your case, instead of
index=test | where Value>=95
you do
index=test Value>=95
This will speed up your searches a lot, because splunk has to fetch a lot less events from disk.
Try replacing the 'where' with an eval in your stats command:
index=test
| stats count(eval(Value>=95)) AS Events by Host
That should result in either a count of your events that have the field Value >= 95 or 0 if no events meet that criteria.
The result for me is a table with multiple hosts and a 0 under Events. Can this be refined to just return a general 0 or message if there are no values above 95 (instead of multiple lines, just 1) ?
haha .. never mind ... just remove the Host at the end ...
index=test
| stats count(eval(Value>=95)) AS Events