Hi  Could someone help to let me know how to display fields stating "file is missing" in Splunk DB query output when no output is expected Currently the below query returns- | dbxquery query=" select * from ............................ ;" connection="to_connect" > No results found Expected output- file missing   file missing    file missing (if possible ...different texts in different columns, not sure if eval/fillnull command can be used here) ... View more

I am having below search string and suppose the file "magic_new.log" has no events and the requirement is to show that as output index=magic  source IN ("D:\\show\\magic.log", "D:\\show\\magic_new.log", "D:\\show\\magic_old.log") | stats count by source | where count=0 current output- no results found expected output- source                                                    count D:\show\magic_new.log                0  (Note: Tried multiple solutions suggested in the community but none worked) ... View more

Hi guys, For a dashboard panel, I am running base search and hoping to have a checkbox that returns the timechart data while selecting the check box. Not sure what changes needs to be done to the following query- (also I guess the tag placement for row, panel & chart needs to be aligned) <search id="base_search"> <query>index=magic host="abc*" $check1$</query> <earliest>-120m@m</earliest> <latest>now</latest> </search> <fieldset submitButton="false"> <input type="checkbox" token="check1" searchWhenChanged="true"> <label>box</label> <choice value="*">All</choice> <search base="base_search"> <query>| search "abracadabra" | timechart span=5m count </query> </search> <fieldForLabel>check1</fieldForLabel> <fieldForValue>check1</fieldForValue> </input> </fieldset> ... View more