Splunk display a value when no logs are found

[Dayalss]

Hi ,

I have a field which has 3 values i.e., 0 , 1 & 2.

0 for Green , 1 for Blue and 2 for Red. I'm using this values to show colour differences in dashboard.

But the search fetches data only at a particular time in a day , so the remaining time there is no data.

When there is no data , the dashboard is not loading. 

I want to indicate no data with black colour in the dashboard.

How can I do that? where in if there is no day I can create and map a field value in dashboard

[Dayalss]

Its not working , because I'm tracking the field Status for colour change using below query

index = xyz sourcetype =abc
|eval Status =if(Statistic=0,"Green" , if(Statistic=2 ,"Red",if(Statistic=1,"Blue", " " )))
|stats latest(Status)

Can you please suggest according to above query?

[richgalloway]

I suspect you were too literal in applying my answer.  Try this

index = xyz sourcetype =abc
| eval Status=case(Statistic=0,"Green" , 
                   Statistic=2,"Red",
                   Statistic=1,"Blue", 
                   1==1, " " )
| appendpipe [ stats count | eval Status="Black" | where count=0 | fields - count]
| stats latest(Status)

[richgalloway]

Use the appendpipe command to add values when none are returned by your query.

<<your search>>
| appendpipe [ stats count | eval colour="black" | where count = 0 | fields - count]