Try this adding at the end of query. index.... sourcetype..... |appendpipe [stats count | where count==0] Thanks, Sai ,Try this adding at the end of query. index=...... sourctype...... |appendpipe [stats count | where count==0] Thanks, sai kiran ... View more