Splunk Search

want 0 count if keyword does not match

abhayneilam
Contributor

index="usb_weekly_data" |rex field="src_file_name" (?(?i)"presentation") | stats count as First by key_word

above query returns me :

presentation 47

but if I change the keyword to "halla" then it is not matching in the "src_field_name" field, then it should give me 0 as an output like :

halla 0

Please help me to get this type of 0 output for non-matching keywords !!

Please help me this time, I have been searching for the solution , but didnt get yet !!

Your help would be highly appreciated !!

Thanks in Advance

Tags (5)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

This previous answer may help so that you can represent no results found as a 0:

http://splunk-base.splunk.com/answers/59589/no-results-found-to-be-represented-as-null-or-0

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

This previous answer may help so that you can represent no results found as a 0:

http://splunk-base.splunk.com/answers/59589/no-results-found-to-be-represented-as-null-or-0

abhayneilam
Contributor

Many Many thanks sdaniels for this , this really helped me a lot, I appreciate your help for this and hope to get same assistance in future also. Once again very very thanks 🙂

Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...