Splunk Search
Highlighted

Display "Zero" when 'stats count' value is '0'

New Member

I would like to display "Zero" when 'stats count' value is '0'

index="myindex" "client.ipAddress" IN ( 10.12.12.13,10.12.12.14 ) | stats count

0 Karma
Highlighted

Re: Display "Zero" when 'stats count' value is '0'

Influencer

Use eval command with if statement.

index="myindex" "client.ipAddress" IN ( 10.12.12.13,10.12.12.14 ) | stats count | eval count=if(count==0, "Zero", count)

This page has some good examples, check this:
https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/EvalCommandExamples

View solution in original post

0 Karma
Highlighted

Re: Display "Zero" when 'stats count' value is '0'

Esteemed Legend

Just add this:

... | replace "0" WITH "Zero" IN count
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.