Hi arunsoni,
give this run everywhere search a try:
index=_internal sourcetype=splunkd use anything here
| stats count by sourcetype
| append
[| stats count
| eval sourcetype=if(isnull(sourcetype), "Nothing to see here, move along!", sourcetype)]
| streamstats count AS line_num
| eval head_num=if(line_num > 1, line_num - 1, 1) | where NOT ( count=0 AND head_num < line_num ) | table sourcetype count
Change the message in the sub search to what ever you want to display. It will only be shown if you have no events from the search.
Hope this helps ...
cheers, MuS
UPDATE:
after the comment this search :
index=_internal sourcetype=splunkd foo bar
| stats count by sourcetype
| appendcols
[| stats count
| eval sourcetype=if(isnull(sourcetype), null(), sourcetype) ]
| streamstats count AS line_num
| eval head_num=if(line_num > 1, line_num - 1, 1)
| where NOT ( count=0 AND head_num < line_num )
| table sourcetype count
| transpose
| transpose header_field=column
| fields - column
provided the expect result.
... View more
