Splunk Search

want 0 count if keyword does not match

abhayneilam
Contributor

index="usb_weekly_data" |rex field="src_file_name" (?(?i)"presentation") | stats count as First by key_word

above query returns me :

presentation 47

but if I change the keyword to "halla" then it is not matching in the "src_field_name" field, then it should give me 0 as an output like :

halla 0

Please help me to get this type of 0 output for non-matching keywords !!

Please help me this time, I have been searching for the solution , but didnt get yet !!

Your help would be highly appreciated !!

Thanks in Advance

Tags (5)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

This previous answer may help so that you can represent no results found as a 0:

http://splunk-base.splunk.com/answers/59589/no-results-found-to-be-represented-as-null-or-0

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

This previous answer may help so that you can represent no results found as a 0:

http://splunk-base.splunk.com/answers/59589/no-results-found-to-be-represented-as-null-or-0

abhayneilam
Contributor

Many Many thanks sdaniels for this , this really helped me a lot, I appreciate your help for this and hope to get same assistance in future also. Once again very very thanks 🙂

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...