Hi. I am running below search. Sometimes error does not happen but in that case, stats command shows no data.
Can I show column still with some default value when the error is not happening? I want to show no data as 'NOERRORHere' ?
index=*tech* index=digital_technical_api_gw_hac_raw " New Message Response notification related " | join type=outer host [|inputlookup gw_list] | stats values(apiName) AS API ,values(host) AS host count(eval(statusCode>400)) AS HttpResponseMoreThan400, count(eval(statusCode<400)) AS HttpResponseLessThan400 tp_set , source | join type=outer max=0 [ search index=*tech* index=digital_technical_api_gw_hac_raw ("com.ncipher.nfast.connect.StatusNotOK" OR "An Exception was caught while trying to decrypt the data") | join type=outer host [|inputlookup gw_list] | stats count as HSMErrorCountsOnGivenStripe by tp_set , source ]
Hello,
Maybe you can try to add something like this?
| eval output=case(HSMErrorCountsOnGivenStripe=0, "No Errors Here", HSMErrorCountsOnGivenStripe>0, HSMErrorCountsOnGivenStripe)
| table output
Kind Regards,
Willem