https://community.splunk.com/t5/Splunk-Search/Showing-0-instead-of-no-results-how-to-get-this-line-to-append/m-p/603042#M209871 <P>Use the <FONT face="courier new,courier">appendpipe</FONT> command to detect the absence of results and insert "dummy" results for you.</P><LI-CODE lang="markup">| inputlookup append=t NEW.csv | lookup OLD.csv UniqueID OUTPUTNEW UniqueID as NEW | where like(ISSUE,"%Wrong%") | where isnull(NEW) | stats count as New_event by DATE_REPORT | eval Date=strftime(strptime(DATE_REPORT, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y") | appendpipe [ stats count | eval DATE_REPORT=strftime(now(), "%m-%d-%Y") | eval New_event=0 | where count=0 | fields - count ] | fields Date New_event</LI-CODE><P>&nbsp;</P> Thu, 23 Jun 2022 15:54:08 GMT richgalloway 2022-06-23T15:54:08Z https://community.splunk.com/t5/Splunk-Search/Showing-0-instead-of-no-results-how-to-get-this-line-to-append/m-p/603019#M209866 <P>Hi Everyone: I have this query on which is comparing the file from last week to the one of this one. I'm doing this to bring new events by date, but when there is no results found it is no showing me the Date and a 0, and I need this line to append it to another lookup.</P> <P>| inputlookup append=t NEW.csv<BR />| lookup OLD.csv UniqueID OUTPUTNEW UniqueID as NEW<BR />| where like(ISSUE,"%Wrong%")<BR />| where isnull(NEW)<BR />| stats count as New_event by DATE_REPORT<BR />| eval Date=strftime(strptime(DATE_REPORT, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y")<BR />| fields Date New_event</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>I would like to get something like this:</P> <P>Date&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;New_event<BR />6-23-2022&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0</P> Thu, 23 Jun 2022 21:12:08 GMT https://community.splunk.com/t5/Splunk-Search/Showing-0-instead-of-no-results-how-to-get-this-line-to-append/m-p/603019#M209866 fereze 2022-06-23T21:12:08Z https://community.splunk.com/t5/Splunk-Search/Showing-0-instead-of-no-results-how-to-get-this-line-to-append/m-p/603042#M209871 <P>Use the <FONT face="courier new,courier">appendpipe</FONT> command to detect the absence of results and insert "dummy" results for you.</P><LI-CODE lang="markup">| inputlookup append=t NEW.csv | lookup OLD.csv UniqueID OUTPUTNEW UniqueID as NEW | where like(ISSUE,"%Wrong%") | where isnull(NEW) | stats count as New_event by DATE_REPORT | eval Date=strftime(strptime(DATE_REPORT, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y") | appendpipe [ stats count | eval DATE_REPORT=strftime(now(), "%m-%d-%Y") | eval New_event=0 | where count=0 | fields - count ] | fields Date New_event</LI-CODE><P>&nbsp;</P> Thu, 23 Jun 2022 15:54:08 GMT https://community.splunk.com/t5/Splunk-Search/Showing-0-instead-of-no-results-how-to-get-this-line-to-append/m-p/603042#M209871 richgalloway 2022-06-23T15:54:08Z https://community.splunk.com/t5/Splunk-Search/Showing-0-instead-of-no-results-how-to-get-this-line-to-append/m-p/603074#M209879 <P><EM>It works! Thanks!</EM></P> Thu, 23 Jun 2022 20:05:16 GMT https://community.splunk.com/t5/Splunk-Search/Showing-0-instead-of-no-results-how-to-get-this-line-to-append/m-p/603074#M209879 fereze 2022-06-23T20:05:16Z