Splunk Search

show value in case of no results found

avivn
Explorer

hello,
I'm trying to do a stats count command and to show "0" (for single value chart) instead of N/A in case the query gets no results found.
i tried fillnull but nothing happened.

thank you

Tags (1)
0 Karma

sundareshr
Legend

Try this

base search returning single value | append [| makeresults | eval samefieldasreturnedbybasesearch=0] | head 1

richgalloway
SplunkTrust
SplunkTrust

If there are no results from your query there is nothing for fillnull to fill.

Try this, replacing processCount with the field from your stats command:

your base search | appendpipe [ stats count | eval processCount=0 | where count==0 | fields - count ]
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...