Files not show in the Results will need be show in the results with Status=pending

[rchams]

index=XXXX sourcetype=XXXX ("filename1" OR "filename2" OR filename3) 

| rex "(?<status>passed) request\=\[\/\w+\/(?<to_DST_Filename>.*.txt)\.\w+\."
| rex "(?<status>orig) request\=\[(?<to_DST_Filename1>.*.txt)\.\w+\."
| eval to_DST_Filename = coalesce(to_DST_Filename,to_DST_Filename1)
| fields _time to_DST_Filename
| eval Staus_1 = if(substr(to_DST_Filename,3,4)="hold","Duplicate","Transferred")
| eval Status1 = if(like(to_DST_Filename,"%dup%"),"Duplicate","Transferred")
| eval Status = coalesce(Status_1,Status1)
| fields _time to_DST_Filename Status
| table _time to_DST_Filename Status
| rename _time as "Time_Sent_by_SI"
| convert ctime(Time_Sent_by_SI)
| dedup to_DST_Filename
| search to_DST_Filename!="" AND Status=Transferred

In the above search the three files "filename1" OR "filename2" OR "filename3" will not always have results. I'm looking for the results like, if any file is not shown in the results,

result will be show with file name and status=pending. 

Looking for Results like below:

Filename                                                Status

filename1                                             Transferred

filename2                                              Transferred

filename3                                                 Pending

[richgalloway]

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

[rchams]

@richgalloway  Thanks for the response but the link is not useful for my request.

[richgalloway]

How is it not relevant?  The way I read the question, you have three possible values in your index and you want to display certain text when one of them is not found.  That seems exactly like what the link describes.  If I'm wrong then please clarify the question.

[rchams]

@richgalloway  The fillnull command changing null values to zero but i'm looking for different results.

If one of the file is missing in my results, the missing file show as with Status=Pending in the results.

For example:

the result i'm seeing is:

filename        status

filename1     Transferred

filename3      Transferred

In the result filename2 is no results

looking for result like below, if the filename2 has no results it should be show as Pending

Results looking like:

filename        status

filename1     Transferred

filename2      Pending

filename3      Transferred

[richgalloway]

The fillnull command can populate fields with values other than zero.  For example,

| fillnull value="Pending" status

Please share your current query.