Show a message even when no events are returned using Sttats with by clause

[rkmaggidi]

Hi All,

I have situation where I want to show a message instead of empty cell.

I am using below query to get some data:

somesearch | rex field=msg "ErrorCode\\":(?\d+)"

| eval Status= case(StatusCode==200,"UP",1=1,"DOWN")
| eval Core=upper(substr(cf_scp_name,-3))
| stats latest(Status) as Status , dc(host) as noOfInstances by cf_app_name, Core
| eval noOfInstances = case(Status=="UP", noOfInstances, 1=1, 0)
| eval Status= Status + " (" + noOfInstances +")"
| table cf_app_name, Core,Status
| eval {Core}=Status
| fields - Core, Status
| stats values() as * by cf_app_name

and getting results in as shown in below image

here for some of the components I don't have any events in splunk. So I want to show it as down. how can I achieve this ?

Thank in advance.

[richgalloway · Accepted solution]

Try ... | fillnull value="DOWN".

[rkmaggidi]

Thank you very much.