Hello,
How do I get a single value display to show a value of zero instead of no results? I've tried fillnull
in various spots in my search but I can't seem to get it to work.
Thanks
See if this works (name of the column (x) should be same in both searches)
index=_internal "return zero" | table x | append [| makeresults | eval x=0 | table x] | head 1
I think that might have done the trick!!!
Thanks
Just a little addition to this: you can run use stats
and eval
to do the same - see this answer https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html the learn more on this topic.
cheers, MuS
Please mark accepted to close this out.