How to get a single value display to show a value of zero instead of no results?

[sidekix24]

Hello,

How do I get a single value display to show a value of zero instead of no results? I've tried fillnull in various spots in my search but I can't seem to get it to work.

Thanks

[sundareshr]

See if this works (name of the column (x) should be same in both searches)

index=_internal "return zero" | table x | append [| makeresults | eval x=0 | table x] | head 1

[sidekix24]

I think that might have done the trick!!!

Thanks

[MuS]

Just a little addition to this: you can run use stats and eval to do the same - see this answer https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html the learn more on this topic.

cheers, MuS

[sundareshr]

Please mark accepted to close this out.