So I have a query:
index=......
| bucket _time span=5m
| timechart count as alerts
The search itself runs fine and when there are results to return, I get the number as expected (the number of records in each time period). My problem is if there is nothing at all to return in the search I get "Not Results Found...." and would instead like a 0 displayed. I have tried adding "| fillnull value=0" ad the end after the time chart but still no luck.
Thoughts?
HI troyward,
have a look at this answer https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html where you can find a way to do it.
Hope this helps ...
cheers, MuS
HI troyward,
have a look at this answer https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html where you can find a way to do it.
Hope this helps ...
cheers, MuS