If there are no results found, how do I get my search to return a field that has the value of zero?

[smcdonald20]

I have the following search:

index=ad source=otl_adgroupmemberscan memberSamAccountName=jbloggs
|dedup memberSamAccountName, groupSamAccountName
|table groupSamAccountName, memberSamAccountName

If there are no results, I want it to show a field that have a value of zero.

If there are results though, it's important the search still returns all of the values of groupSamAccountName and memberSamAccountName

[cmerriman · Accepted solution]

index=ad source=otl_adgroupmemberscan memberSamAccountName=jbloggs
|dedup memberSamAccountName, groupSamAccountName
|table groupSamAccountName, memberSamAccountName
| appendpipe [ stats count | eval "NoResults"="0"  | where count=0 |table "NoResults"]

you could name the "NoResults" field to groupSamAccountName or memberSamAccountName and it would replace that field value if there are no results.

[smcdonald20]

Thank you! this worked exactly how I wanted it to.