index=xxxx source="/esbplogsdir/prod/Enable/LOG_Maximo_LSI_Work/Maximo/LSI_IN_msg_prod.log" OR source="/esbplogsdir/prod/WS/LOG_Maximo_SmallWorld_IPICustomerInfo/Maximo/SmallWorld_IN_msg_prod.log" | rex "(?i).*? \\- (?P<FIELDNAME>[a-f0-9]+\\-[a-f0-9]+\\-[a-f0-9]+\\-[a-f0-9]+\\-[a-f0-9]+)(?= )" | rex "(?i):.*? \\- (?P<FIELDNAME>\\d+\\.\\d+)(?= )" | search "[ERROR]" OR "failed" |stats dc(FIELDNAME) as ERROR_TRANSACTION_COUNT by source | rename source as SOURCE
This is the search, but if one or both sources have a 0 return, I want a line that lists the log file and a 0 to show in my table. How can I do this?
