how to show 0 when no search result found

[cyberportnoc]

after succeed with

"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | where Infected=0 | stats sum(linecount) as resultofscan | eval typeofresult="totalofnotinfected" | table typeofresult, resultofscan

to show a summary

then when deal with 0 case

"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | where Infected>0 | stats sum(linecount) as resultofscan | eval totalofinfected=if(linecount=0,0,0)  | eval scanresult="totalofinfected" | table typeofresult, resultofscan

when infected > 0 , no search result found, it has problem

final should be like

typeofresult               resultofscan
totalofnotinfected     100
totalofinfected               0
total                             100


    "Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | where Infected=0 | stats sum(linecount) as resultofscan | eval typeofresult="totalofnotinfected" | table typeofresult, resultofscan
 | append [ |"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | where Infected>0 | stats sum(linecount) as resultofscan | eval totalofinfected=if(linecount=0,0,0)  | eval scanresult="totalofinfected" | table typeofresult, resultofscan ]

2.. as do not know how to sum the total after append table
then i hard code a total, but it can not append this hardcoded total to table

| append [ | eval resultofscan=36 | eval typeofresult="total" | table typeofresult, resultofscan ]

[cmerriman · Accepted solution]

do you need the append?
can you do something like this:

"Infected files:" | rex field=_raw "Infected files: (?<Infected>\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date  | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") 
|eval typeofresult=case(Infected=0,"totalofnotinfected","totalofinfected")
| stats sum(linecount) as resultofscan by typeofresult
|appendpipe [stats count |eval typeofresult="totalofinfected"|where count==1|table typeofresult]
|fillnull resultofscan value=0
|addcoltotals resultofscan

[cyberportnoc]

Error in 'eval' command: The arguments to the 'case' function are invalid.

if there is another method besides append, it can also use it

[cyberportnoc]

succeed with
"Infected files:" | rex field=_raw "Infected files: (?\d*)" | convert timeformat="%Y-%m-%d" ctime(_time) AS date | table source, date, Infected, linecount | where date=strftime(now(), "%Y-%m-%d") | eval typeofresult=if(Infected=0,"totalofnotinfected","totalofinfected") | stats sum(linecount) as resultofscan by typeofresult | appendpipe [stats count |eval typeofresult="totalofinfected"|where count==1|table typeofresult]
| fillnull resultofscan value=0
| addcoltotals resultofscan

[cyberportnoc]

i change case to if

[cmerriman]

oh sorry, my mistake 🙂