I have a query similar to the one below.  index = "idx" source = "mysource"  |spath path=myField output=res|stats count by res | where res="xyz" Is there a way to get the search to return zero if no rows are returned? The reason Im asking for this is because this is the query Im using to populate values into a dashboard panel. If no rows are returned I would prefer the panel show zero instead of no results.  ... View more

Hey everyone...I know there has to be an easy way to do what I want, but I just can't figure out how. It should be straightforward, but apparently I can't figure it out.  I have a dropdown and depending on its value, I want to change my search criteria for dependent widgets. For example:  I have a single value widget on my dashboard. The default search query for that widget is  index='idx' source='src1'.... If someone picks the second element in the dropdown (label = "My Second Element", value = 'secondelement') I want the search query to change to  index='idx' source='src2'.... and for the dashboard to refresh. Similarly, when selecting the first element, I want it to go back to source = 'src1'.  I don't have any sort of submit button and am puzzled by similar answers to other questions that include a wall of xml. It seems to me that this should be doable via an if statement in the query or by parameterizing the query before its run. I'm obviously ignorant about large swaths of splunk, so please explain it like Im five. 🙂 ... View more