Dashboards & Visualizations

DIsplay 0 when no results returned in single value

ipops
Path Finder

I have the following search which parses delimited fields.

sourcetype=ivrdata | eval {message}=varValue | stats first(LogTimestamp) as Time values(Network) as Network values(Phone) as Phone values(Tower) as Tower values(Platform) as Platform values(Province) as Province by IVR_SessionID | WHERE Platform="Test" AND Tower="99" | eval _time=Time | stats count by _time | accum count

I want to display the count as a singlevalue on a dashboard. When the search returns no results, the singlevalue displays "N/A". How can I make this show 0 instead?

I tried adding "fillnull 0" before the stats statement but still does not work. any ideas?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...