show empty table instead of no results found

[jeroenborger]

hello splunk communitie, i am new to splunk but found allot of information allready but i have a problem with the given statement down below. in normal situations this search should not give a result. but then it shows as no results found and i want that is just shows 0 on all fields in the table. but when there are results it needs to show the results and not the 0.

i tried to do it with a eval if statement.
i tried it with the fillnull statement.

index=msad OR windows OR wineventlog host=%hostname% EventCode=4897 NOT (user="*$" OR user="-")

| dedup _time
| stats count,Values(Token_Elevation_Type) as "Token" by user Token_Elevation_Type
| table host,user,count,Token
| sort - count

greetings Jeroen

[renjith_nair · Accepted solution]

@jeroenborger ,

try

| appendpipe [|stats count|where count=0]|fillnull value=0 host,user,Token

In b/w fields in your stats command and table command does not match. You might see null for those fields which are not part of your stats, for e.g. host.

index=msad OR windows OR wineventlog host=%hostname% EventCode=4897 NOT (user="*$" OR user="-") 
| dedup _time 
| stats count,Values(Token_Elevation_Type) as "Token" by user Token_Elevation_Type
| appendpipe [|stats count|where count=0]|fillnull value=0 Token,user,Token_Elevation_Type

[jeroenborger]

thanks your statement works like i want 🙂 thank you for the help!