Showing 0 instead of no results, how to get this line to append to another lookup?

[fereze]

Hi Everyone: I have this query on which is comparing the file from last week to the one of this one. I'm doing this to bring new events by date, but when there is no results found it is no showing me the Date and a 0, and I need this line to append it to another lookup.

| inputlookup append=t NEW.csv
| lookup OLD.csv UniqueID OUTPUTNEW UniqueID as NEW
| where like(ISSUE,"%Wrong%")
| where isnull(NEW)
| stats count as New_event by DATE_REPORT
| eval Date=strftime(strptime(DATE_REPORT, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y")
| fields Date New_event

I would like to get something like this:

Date                           New_event
6-23-2022               0

[richgalloway · Accepted solution]

Use the appendpipe command to detect the absence of results and insert "dummy" results for you.

| inputlookup append=t NEW.csv
| lookup OLD.csv UniqueID OUTPUTNEW UniqueID as NEW
| where like(ISSUE,"%Wrong%")
| where isnull(NEW)
| stats count as New_event by DATE_REPORT
| eval Date=strftime(strptime(DATE_REPORT, "%Y-%m-%d %H:%M:%S"), "%m-%d-%Y")
| appendpipe [ stats count | eval DATE_REPORT=strftime(now(), "%m-%d-%Y") | eval New_event=0 | where count=0 | fields - count ]
| fields Date New_event

[fereze]

It works! Thanks!