I'm interested in showing a large "0" when the search results have no results. The results are in a table format.
somesearch | table col1 col2 col3
Is this possible?
Take a look at this answer http://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas.html
Hope this helps ...
Try the solution mentioned here