I have a query base query | stats count by ABC | fillnull
but i am getting "no result"
instead of this, i want to display ABC count as "zero"
Try this - from here: https://answers.splunk.com/answers/467823/if-there-are-no-results-found-how-do-i-get-my-sear.html
base query | stats count by ABC | appendpipe [ stats count | eval "NoResults"="0" | where count=0 |table "NoResults"]
View solution in original post
