Splunk Search
Highlighted

Display "Zero" when 'stats count' value is '0'

New Member

I would like to display "Zero" when 'stats count' value is '0'

index="myindex" "client.ipAddress" IN ( 10.12.12.13,10.12.12.14 ) | stats count

0 Karma
Highlighted

Re: Display "Zero" when 'stats count' value is '0'

Influencer

Use eval command with if statement.

index="myindex" "client.ipAddress" IN ( 10.12.12.13,10.12.12.14 ) | stats count | eval count=if(count==0, "Zero", count)

This page has some good examples, check this:
https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/EvalCommandExamples

View solution in original post

0 Karma

Re: Display "Zero" when 'stats count' value is '0'

Esteemed Legend

Just add this:

... | replace "0" WITH "Zero" IN count
0 Karma