splunk

[Siddharthnegi]

I want to see 100% when the "No results found. " message comes.

[ITWhisperer]

Try something like this

| appendpipe
  [| stats count as _count
   | where _count=0
   | eval message="100%"]

[Siddharthnegi]

What if I want to show 100% in existing field.
let say i have a sum field which showing 0, so i want to show 100% is there a way to do that?

[ITWhisperer]

| appendpipe
  [| stats count as _count
   | where _count=0
   | eval sum="100%"]

[Siddharthnegi]

Thanks for the answer but can i do this without appendpipe