I have an embedded pie chart where I'm trying to show something rather than "no results found" with the red exclamation mark, and this is making people think the report isn't working. I've tried several methods to address this, but I can't get the results I would like.
Query and results:
| inputlookup my_lookup
| search Exposure=External
| stats count by Status
| eval pie_slice = count + " " + Status
| fields pie_slice, count
Is it possible to add something to the query so that when there are zero results I get this?
The appendpipe command usually is used in this case.
| inputlookup my_lookup
| search Exposure=External
| stats count by Status
| appendpipe [ stats count as Count | eval Status="No results",count=1 | where Count=0 | fields - Count ]
| eval pie_slice = count + " " + Status
| fields pie_slice, count
The appendpipe command usually is used in this case.
| inputlookup my_lookup
| search Exposure=External
| stats count by Status
| appendpipe [ stats count as Count | eval Status="No results",count=1 | where Count=0 | fields - Count ]
| eval pie_slice = count + " " + Status
| fields pie_slice, count