Change the ''Waiting for data... '' message with a value or word

[andrei1bc]

My search :

  index=test
  | where Value>=95
  | stats count(Value) as Events by Host

The result :

• if there are values above 95 a table will be created by Host and number of Events per host
• if there are no values above 95 i would like to return just a message "test" or an Event field as 0

[jeffland]

Generally, try to limit the data you search over as early as possible. In your case, instead of

index=test | where Value>=95

you do

index=test Value>=95

This will speed up your searches a lot, because splunk has to fetch a lot less events from disk.

[vasildavid · Accepted solution]

Try replacing the 'where' with an eval in your stats command:

index=test
| stats count(eval(Value>=95)) AS Events by Host

That should result in either a count of your events that have the field Value >= 95 or 0 if no events meet that criteria.

[andrei1bc]

The result for me is a table with multiple hosts and a 0 under Events. Can this be refined to just return a general 0 or message if there are no values above 95 (instead of multiple lines, just 1) ?

[andrei1bc]

haha .. never mind ... just remove the Host at the end ...

  index=test
  | stats count(eval(Value>=95)) AS Events