I have the following search which parses delimited fields.
sourcetype=ivrdata | eval {message}=varValue | stats first(LogTimestamp) as Time values(Network) as Network values(Phone) as Phone values(Tower) as Tower values(Platform) as Platform values(Province) as Province by IVR_SessionID | WHERE Platform="Test" AND Tower="99" | eval _time=Time | stats count by _time | accum count
I want to display the count as a singlevalue on a dashboard. When the search returns no results, the singlevalue displays "N/A". How can I make this show 0 instead?
I tried adding "fillnull 0" before the stats statement but still does not work. any ideas?