Display result=0 rather than "No Results Found"

[dpdwibedy]

Hi All,

I'm using a query to get the total total count of  a field ( different error messages ) .
Here is the search and stats being displayed:

index=sp_dev  "ProductHandler" | rex field=message "operation\\\":\\\"(?<ErrorMessage>[A-Za-z]+)\\\""| stats count(ErrorMessage) as TotalErrors

TotalErrors

xxxx

Now I want to alert a trigger , when  the error count  is "0"

If I use : 

 index=sp_dev  "ProductHandler" | rex field=message "operation\\\":\\\"(?<ErrorMessage>[A-Za-z]+)\\\""| stats count(ErrorMessage) as TotalErrors | where TotalErrors=0

It is not giving me  result as "0" , rather than "No Results Found" .

If  I use "where TotalErrors>0" I see the results.

So question is , how can I convert   the  "No Results Found"  to  value as "0"

Thanks,

DD

[dpdwibedy]

Hi All,

I'm using a query to get the total total count of  a field ( different error messages ) .
Here is the search and stats being displayed:

index=sp_dev  "ProductHandler" | rex field=message "operation\\\":\\\"(?<ErrorMessage>[A-Za-z]+)\\\""| stats count(ErrorMessage) as TotalErrors

TotalErrors

xxxx

Now I want to alert a trigger , when  the error count  is "0"

If I use : 

 index=sp_dev  "ProductHandler" | rex field=message "operation\\\":\\\"(?<ErrorMessage>[A-Za-z]+)\\\""| stats count(ErrorMessage) as TotalErrors | where TotalErrors=0

It is not giving me  result as "0" , rather than "No Results Found" .

If  I use "where TotalErrors>0" I see the results.

So question is , how can I convert   the  "No Results Found"  to  value as "0"

Thanks,

DD

[richgalloway · Accepted solution]

The command 

| where TotalErrors=0

tells Splunk to show the results only if there are no errors found in the index, but if there are no errors then there's nothing to display so you get "No results found".

To send an alert when you have no errors, don't change the search at all.  Just change the alert to trigger when the number of results is zero.

If you really want a zero when there are no results, then try appendpipe.

index=sp_dev  "ProductHandler" 
| rex field=message "operation\\\":\\\"(?<ErrorMessage>[A-Za-z]+)\\\""
| stats count(ErrorMessage) as TotalErrors
| appendpipe [ stats count(ErrorMessage) | eval TotalErrors=0 | where count=0 | fields - count ]

[dpdwibedy]

@richgalloway , Thanks much . That worked.