Zero count not displaying when stats count is used

[Harshi1993]

My query is :

index="stage*" source="*record service*" | eval type=case(like(message, "%successful generated account%"),"Success Accounts",
like(message, "%Granting failed Accounts%"),"Granting failed Accounts", like(message, "%Inbound setup failed accounts%"),"Inbound  failed Accounts")|
stats count as Results by type

I am getting the result as:

type                                               Results

Success Accounts                   10

Granting failed Accounts       20

I am unable to get the results for the string  Inbound failed Accounts as the results are zero. I need the output as 

type                                               Results

Success Accounts                   10

Granting failed Accounts       20

Inbound  failed Accounts         0

Please help me with the query for displaying the strings with zero count as well

[renjith_nair]

Try

index="stage*" source="*record service*" 
| eval type=case(like(message, "%successful generated account%"),"Success Accounts",
like(message, "%Granting failed Accounts%"),"Granting failed Accounts", like(message, "%Inbound setup failed accounts%"),"Inbound  failed Accounts")
|stats count as Results by type
|append [|stats count as Results|eval type="Success Accounts,Granting failed Accounts,Inbound  failed Accounts"|makemv type delim=","|mvexpand type]
|stats sum(Results) by type

[PickleRick]

It's a typical mistake to want to have knowledge about _what_ was done earlier "down the road" whereas Splunk doesn't work that way.

After a pipe you get only a _result_ of the command from before the pipe. So if any command is supposed to look for - let's say - one of three different values but finds only two of them, the result will only have two of those values and any subsequent command won't have the knowledge that you wanted to search for the third value as well. You only get the results.

So the most obvious workaround in such case as yours is - as @ITWhisperer showed - creating an initial set of "empty" (with a value of zero) result set and then sum this set with your actual result. That way if you don't have any other results, you'll just stay with your static results of zero hits.

[ITWhisperer]

| append [| makeresults
| eval type=split"Success Accounts|Granting failed Accounts|Inbound  failed Accounts","|")
| mvexpand type
| eval Results=0
| table type Results]
| stats sum(Results) as Results by type