Return 0 when "no results found"

[moizmmz]

Hello,

In the following query, I'm hoping to return the value 0 to my dashboard panel if no results are found by the search query.

index=test "slice_played" externalUserID="$ext$" assetID!="806d682119ac46d18b9f4a5f3dc20b10"
assetID!="5c117f3141244a3a9d6899395b5c65aa" $ass$
| stats sum(duration) as "y_seconds"

Please help! I've tried using the solution asked in a similar question, but to no avail.

[woodcock]

Add this to the bottom of your search SPL string:

| appendpipe [stats count | where count=0]

You can thank @martin_mueller for this!

[MuS]

Hi moizmmz,

need to trick Splunk for this, because if there are no events Splunk will show No results found. So you need to add fake events and do some logic around. Try this run everywhere search:

index=_internal sourcetype!=splunkd_* baz
| append 
    [| makeresults 
    | stats count(foo) AS count 
    | eval _raw="Nothing to see here, move along!"] 
| streamstats count AS line_num 
| eval head_num=if((line_num > 1),(line_num - 1),1) 
| where (true() XOR ((count == 0) AND (head_num < line_num))) 
| fields - column, count, head_num, line_num 
| sort -_time | table *

The benefit of this search is that if there are no events it will only show one column with the message 😉

Hope this helps to get you started ...

cheers, MuS

PS: another example can be found here https://answers.splunk.com/answers/704513/how-do-i-show-0-when-no-results-are-found-in-a-rep.html

[Vijeta]

@moizmmz- Try below

index=test "slice_played" externalUserID="$ext$" assetID!="806d682119ac46d18b9f4a5f3dc20b10" assetID!="5c117f3141244a3a9d6899395b5c65aa" $ass$ | append [|makeresults| eval duration=0]|stats sum(duration) as "y_seconds"

[koshyk]

Please try

<your search>..
| fillnull value=0 duration 
| stats sum(duration)  as "y_seconds"

[moizmmz]

Tried this. Doesn't Work 😞

[koshyk]

please provide some sample data and final output how you want to look like and we could write it for u

[moizmmz]

Thats the thing though. For now, it returns "No results found". So instead of seeing "No results found" in my dashboard panel, I want to see 0 !!

[koshyk]

strange. what i've done is, if the value is empty, put the value to 0. So it will sum up 0 and should show 0. But anyways

[moizmmz]

Yeah!!! that's exactly what I thought!

[moizmmz]

Thanks though 🙂