https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398365#M115548 <P>@ryhluc01 try the following search:</P> <PRE><CODE>index=example sourcetype=exp1 OR sourcetype=exp2 | stats count by sourcetype | append [| makeresults | fields - _time | eval sourcetype="exp1,exp2" | makemv sourcetype delim="," | mvexpand sourcetype | eval count=0] | dedup sourcetype </CODE></PRE> Mon, 14 Jan 2019 18:55:52 GMT niketn 2019-01-14T18:55:52Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398363#M115546 <P>I have 2 source types that run every morning at 8:30am.</P> <P>If 1 or more does not, I need to still see the source types as having a value of 0 instead of displaying "No results found. Try expanding the time range.". </P> <P>Overall: I need all the specified source type names to be returned within the results so that I can assign a value of 0 to them. </P> <P>This is what I have: </P> <PRE><CODE>index=example sourcetype=exp1 OR sourcetype=exp2 | stats count(_time) as count by sourcetype </CODE></PRE> <P>The above syntax will let me know how many reports ran in the last 24 hrs at the time we specified (which is what I want). </P> <P>But, in the event that 1 or both or these reports fail to run, I need to still be able to see each source type within my results. </P> <P>I would like to assign a 0 value to the count for the source type that didn't generate any results. </P> Mon, 14 Jan 2019 16:50:52 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398363#M115546 ryhluc01 2019-01-14T16:50:52Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398364#M115547 <P>Are you wanting to do this in a dashboard on inline in a search?</P> Mon, 14 Jan 2019 18:16:04 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398364#M115547 zonistj 2019-01-14T18:16:04Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398365#M115548 <P>@ryhluc01 try the following search:</P> <PRE><CODE>index=example sourcetype=exp1 OR sourcetype=exp2 | stats count by sourcetype | append [| makeresults | fields - _time | eval sourcetype="exp1,exp2" | makemv sourcetype delim="," | mvexpand sourcetype | eval count=0] | dedup sourcetype </CODE></PRE> Mon, 14 Jan 2019 18:55:52 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398365#M115548 niketn 2019-01-14T18:55:52Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398366#M115549 <P>inline search</P> Mon, 14 Jan 2019 19:06:57 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398366#M115549 ryhluc01 2019-01-14T19:06:57Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398367#M115550 <P>@niketnilay You're amazing. This worked perfectly. Thank you so much for your input ^_^ </P> Mon, 14 Jan 2019 19:10:42 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398367#M115550 ryhluc01 2019-01-14T19:10:42Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398368#M115551 <P>Glad you found this working!</P> Mon, 14 Jan 2019 21:05:52 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398368#M115551 niketn 2019-01-14T21:05:52Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398369#M115552 <PRE><CODE>index=example sourcetype=exp1 OR sourcetype=exp2 | stats count(_time) as total_count eval(count(sourcetype="exp1") as ex1_count eval(count(sourcetype="exp2")) as ex2_count by index </CODE></PRE> <P>This is another tweak you can employ in your search <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 09 Apr 2019 11:04:51 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-search-to-return-results-even-if-there-are-none/m-p/398369#M115552 CryoHydra 2019-04-09T11:04:51Z