Display "Zero" when 'stats count' value is '0'

[sriniavula66]

I would like to display "Zero" when 'stats count' value is '0'

index="myindex" "client.ipAddress" IN ( 10.12.12.13,10.12.12.14 ) | stats count

[woodcock]

Just add this:

... | replace "0" WITH "Zero" IN count

[manjunathmeti · Accepted solution]

Use eval command with if statement.

index="myindex" "client.ipAddress" IN ( 10.12.12.13,10.12.12.14 ) | stats count | eval count=if(count==0, "Zero", count)

This page has some good examples, check this:
https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/EvalCommandExamples