Splunk Search

No results found, I want to show other message!!!

caiyundong
Engager

Search :

index=server1 | table processName porcessCount

result A : search has a results.

processName   processCount

java 14

vi   2

result B : search has no results.

No results found, inspector...

How can i display it below...

processName   processCount

 No Process

Thanks.

Tags (1)
1 Solution

jonuwz
Influencer

Like this :

index=server1 | table processName processCount | appendpipe [ stats count | eval processName="No Process" | eval processCount=0 | where count==0 | fields - count ]

View solution in original post

jonuwz
Influencer

Like this :

index=server1 | table processName processCount | appendpipe [ stats count | eval processName="No Process" | eval processCount=0 | where count==0 | fields - count ]

smolcj
Builder
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>