Display 0 on Single Value When No Records Found

[troyward]

So I have a query:

index=......
| bucket _time span=5m
| timechart count as alerts

The search itself runs fine and when there are results to return, I get the number as expected (the number of records in each time period). My problem is if there is nothing at all to return in the search I get "Not Results Found...." and would instead like a 0 displayed. I have tried adding "| fillnull value=0" ad the end after the time chart but still no luck.

Thoughts?

[MuS · Accepted solution]

HI troyward,

have a look at this answer https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html where you can find a way to do it.

Hope this helps ...

cheers, MuS