Hi,
I have single value visualization if i select for 24 hrs or any other time i am getting results example: 50
If i select for 15 min or less than a hour it is showing output as: "N/A". I want to show the output result as "0" if there are no results instead of N/A
Thanks,
PR
Try like this
your base search | search STATUS = D OR STATUS = A| stats sum(STATUS_COUNT) as count | appendpipe [| stats count | where count=0]
Try like this
your base search | search STATUS = D OR STATUS = A| stats sum(STATUS_COUNT) as count | appendpipe [| stats count | where count=0]
Thanks Somesh.
|rename STATUS_COUNT as sumation |appendpipe [ stats count | eval sumation=if(count==0,0,NULL)|fields - count] this i used working fine
What does your search look like? If you're doing a simple '| stats count' it should return 0 if you have no results during the selected time period.
Hi,
My query ends with "| search STATUS = D OR STATUS = A| stats sum(STATUS_COUNT)
but no luck