Search :
index=server1 | table processName porcessCount
result A : search has a results.
processName processCount
java 14
vi 2
result B : search has no results.
No results found, inspector...
How can i display it below...
processName processCount
No Process
Thanks.
Like this :
index=server1 | table processName processCount | appendpipe [ stats count | eval processName="No Process" | eval processCount=0 | where count==0 | fields - count ]
Like this :
index=server1 | table processName processCount | appendpipe [ stats count | eval processName="No Process" | eval processCount=0 | where count==0 | fields - count ]