show count as zero if no data found

[royimad]

Hello,
I have a search like this: sourcetype="mysource" | stats count by field
I need to show zero if the field doesn't exist in the result how to do that?

Thanks,

[lukejadamec · Accepted solution]

Use fillnull:

sourcetype="mysource" | fillnull value="0" field | stats count by field

[sowings]

"Original Poster" == the person who asked the question.

[lukejadamec]

? fillnull will add the field with a zero value if it does not exist, and add a zero if it has no value. That is what OP wanted. What does OP stand for?

[sowings]

The search you've provided will fill "field" with 0 everywhere, then count the occurrences by the value, where the count of "value=0" will represent the number of events where the field was empty. I'm not quite sure what the OP wanted....