Archive

want 0 count if keyword does not match

Contributor

index="usbweeklydata" |rex field="srcfilename" (?(?i)"presentation") | stats count as First by key_word

above query returns me :

presentation 47

but if I change the keyword to "halla" then it is not matching in the "srcfieldname" field, then it should give me 0 as an output like :

halla 0

Please help me to get this type of 0 output for non-matching keywords !!

Please help me this time, I have been searching for the solution , but didnt get yet !!

Your help would be highly appreciated !!

Thanks in Advance

Tags (5)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

This previous answer may help so that you can represent no results found as a 0:

http://splunk-base.splunk.com/answers/59589/no-results-found-to-be-represented-as-null-or-0

View solution in original post

Splunk Employee
Splunk Employee

This previous answer may help so that you can represent no results found as a 0:

http://splunk-base.splunk.com/answers/59589/no-results-found-to-be-represented-as-null-or-0

View solution in original post

Contributor

Many Many thanks sdaniels for this , this really helped me a lot, I appreciate your help for this and hope to get same assistance in future also. Once again very very thanks 🙂