How to display zero for latest(values)

[varsh_6_8_6]

The following is my query.

index="xyz"  host="*" 
|fields host,messagevalue
| search "total payment count :"
|eval messagevalue=mvindex(split(messagevalue,":"),1)
|stats latest(messagevalue)

For a given period if there are no events, No results found is displayed. Instead I want zeo to be displayed.

I tried using fillnull but no luck.

[ITWhisperer]

| appendpipe [| stats count | where count==0]

[gcusello]

Hi @varsh_6_8_6 ,

you can find many anwers to this question and I proposed it in Splunk ideas to have this feature in fashboards and it's a future prospect, if you think that's interesting, upvote for it at https://ideas.splunk.com/ideas/EID-I-572 

Anyway, in the meantime, only one question before the answer: is messageValue a number or what else?

if it's a number, please try:

index="xyz"  host="*" "total payment count :"
| eval messagevalue=mvindex(split(messagevalue,":"),1)
| stats latest(messagevalue) AS messagevalue
| append [ | makeresults | eval messagevalue=0 | fields messagevalue ]
| stats sum(messagevalue) AS messagevalue

Ciao.

Giuseppe

[varsh_6_8_6]

Hi @gcusello 
Thank you for the inputs. I have voted for the idea which is essential.
Also I have both number and string.
The one mentioned worked perfectly for the number. 
Is there any way to display "No files found" in case there no latest events in a particular time.
Regards,
Varsh

[gcusello]

Hi @varsh_6_8_6 ,

in this case, please try

index="xyz"  host="*" "total payment count :"
| eval messagevalue=mvindex(split(messagevalue,":"),1)
| appendpipe [ stats count | eval messagevalue="No File Found" | where count==0 | fields - count ]

Ciao.

Giuseppe