How to display 0 when there is No Records Found or Nothing returned

[splunkbeginner]

the search (thanks for who provided this) is:

| tstats count where host=linux01 sourcetype="linux:audit" by _time span=1d prestats=t
| timechart span=1d count as total
| appendcols [ search host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls)
| timechart span=1d count as filter]

If there is no matched event to return for "total" and "filter", I get "Not Results Found". If there is no matched event return for "total" or "filter", I get nothing on the timechart for "total" or "filter"

I would instead like a 0 displayed. Any idea will be much appreciated.

[harishalipaka]

@splunkbeginner

try like this

| tstats count where host=linux01 sourcetype="linux:audit" by _time span=1d prestats=t
| timechart span=1d count as total
| appendcols [ search host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls)
| timechart span=1d count as filter]
| stats count as total by sourcetype
 | appendpipe [ stats count as total
 | where total=0
 | eval total=0,filter=0]

[splunkbeginner]

@harishalipaka

thanks but it somehow doesn't work for me.

nevertheless i tried a query from another splunk answer and its working fine.
| appendpipe [ stats count | eval "NoResults"="0" | where count=0 |table "NoResults"]

[to4kawa]

....
| appendpipe [| stats count as total
| where total=0
| eval total=0]

[splunkbeginner]

@to4kawa

thanks but still I get nothing on the timechart for "total" or "filter" when there is no matched event return for "total" or "filter",

[to4kawa]

index=_internal "nothing counts"
| stats count as total by sourcetype
| appendpipe [ stats count as total
| where total=0
| eval total=0]

[splunkbeginner]

@to4kawa

thanks again. maybe i don't know how to fit your suggestion to my search... but thanks anyway.

nevertheless i tried a query from another splunk answer and its working fine.
| appendpipe [ stats count | eval "NoResults"="0" | where count=0 |table "NoResults"]

[to4kawa]

https://answers.splunk.com/answers/733553/how-do-i-append-a-specific-field-with-specific-val.html

[splunkbeginner]

@to4kawa

Thanks for the link. Any idea how i can tune the appendage to yield correct events? Thanks

| tstats count where host=linux01 sourcetype="linux:audit" by _time span=1d prestats=t
| timechart span=1d count as total
| appendcols [ search host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls)
| timechart span=1d count as filter]
| appendpipe
[| timechart count
| where count=0
| eval ???,count=0
| appendpipe
[| eval ???,count=0]]