help on if condition for results = 0

[jip31]

hello

In a panel table, I need to display every key_path even if the key_path result = 0
I have done an if condition but it doenst works
could you help me please??

index="toto" sourcetype="WinRegistry" key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\xx" OR key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\yy" OR key_path="HKLM\\software\\wow6432node\\zz" 
| stats dc(host) as test by sourcetype key_path 
| eval test=if(test==0,"0", test)

[kamlesh_vaghela · Accepted solution]

@jip31

Can you please try this?

index="toto" sourcetype="WinRegistry" key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\xx" OR key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\yy" OR key_path="HKLM\\software\\wow6432node\\zz" 
| stats dc(host) as count by sourcetype key_path | append [| makeresults | eval sourcetype="WinRegistry", count=0, key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\xx||HKLM\\software\\microsoft\\windows nt\\currentversion\\yy||HKLM\\software\\wow6432node\\zz",key_path=split(key_path,"||") | mvexpand key_path | table sourcetype key_path count] | stats sum(count) as count by sourcetype key_path

[jip31]

hi its perfect thanks!

[kamlesh_vaghela]

Great @jip31. Can you please upvote and accept this answer to close this question?