I would like to display "Zero" when 'stats count' value is '0'
index="myindex" "client.ipAddress" IN ( 10.12.12.13,10.12.12.14 ) | stats count
Use eval command with if statement.
index="myindex" "client.ipAddress" IN ( 10.12.12.13,10.12.12.14 ) | stats count | eval count=if(count==0, "Zero", count)
This page has some good examples, check this:
https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/EvalCommandExamples
Just add this:
... | replace "0" WITH "Zero" IN count
Use eval command with if statement.
index="myindex" "client.ipAddress" IN ( 10.12.12.13,10.12.12.14 ) | stats count | eval count=if(count==0, "Zero", count)
This page has some good examples, check this:
https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/EvalCommandExamples