Quantcast
Viewing all articles
Browse latest Browse all 47296

Return '0' when no results found in a table with the corresponding source

Hi Folks, I want to produce a count of events in each of my indexes. Where there isn't any data for the time range I specify in my search, I want to return 0 next to the corresponding index. So far I've tried; index=blah* |timechart span=5m count by index | append pipe [stats count | where count==0] The above returns 0 - but how can I add in the corresponding index name that has 0? thx! R

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>