How can I resolve return 0 for "No Results Found"?

[philh]

Hi, I have a query where I'm extrapolating type based on a conditional then counting by type. This works great when there are events for both cases, but I'd also like to show a value of 0 for a given type when there aren't any events for that type. I've seen some other posts using fillnull and appendpipe but those examples haven't worked for my use case. Any help would be appreciated!

| eval type=if(user_action="place_order", "AddInOrdersPlaced", "AddInForwardedOrders")
| convert timeformat="%Y-%m-%d" ctime(_time) AS date
| chart count over date by type

[isoutamo]

Hi

maybe these answers helps you? Those show way to replace "No results found" with something else.

• https://community.splunk.com/t5/Splunk-Search/If-there-are-no-results-found-how-do-I-get-my-search-t...
• https://community.splunk.com/t5/Reporting/quot-No-results-found-quot-to-be-represented-as-NULL-or-0/...
• https://community.splunk.com/t5/Splunk-Search/Replacing-quot-No-Results-Found-quot-with-quot-0-quot/...

r. Ismo

[diogofgm · Accepted solution]

If you're looking into a time range, and you're using chart over date, the chart won't create the missing dates where both types do not have an event. 
What you can try to do instead is using a timechart that for the given time range with create the missing dates of the span you select.

| eval type=if(user_action="place_order", "AddInOrdersPlaced", "AddInForwardedOrders")
| timechart span=1d count by type
| fillnull value="0" AddInOrdersPlaced AddInForwardedOrders

[philh]

@diogofgm This works great thank you!

[PickleRick]

You can't find something that isn't there. See https://www.duanewaddle.com/proving-a-negative/ for ideas