![]() Stats works because it generates a result even if the count is zero. ![]() because they rely on results to be generated. Unfortunately it does not work with timechart, streamstats, eventstats, etc. If this condition was met, you could click on the message and it would direct you to a place where you could find what you're looking for. For instance, if inputlookup can't find any results you could tell others to manually search elsewhere or in my case, I defined a conditional value to look for the message. The lookup table fillnull.csv would just be something like thisįrom my understanding, the whole point of using stats at the end of the query is to populate a result for count rather than seeing "No Results Found." Why would you want to do this? For me, I used this as an opportunity to substitute the value "0" for a customized message by using eval. The top box shows if there is a result returned and the bottom one shows a dummy result containing zeros if there is no results returned. | inputlookup fillnull.csv | timechart count to Previous Week | inputlookup user_usage.csv | search "click on \\\"SHARE\\\"" (name="Toll_DPM_BT_PADATA_DETAILEDUSERACTIONS_AllEnv") (application="*") NOT (GomezAgent) UserName!="*" | timechart count to Previous Week If you think outside the box a little you could use the panel display feature in the dashboard to just show a different/dummy display when there are no results returned.įor instance I have some single value metrics on a dashboard that normally show N/A if there are no results returned and it also makes the overall panel look a bit untidy. However if there are none, it will display "No results found" hwere I really want it to just display 0. It will return the total number of login failed events if any are generated. ![]() | eval total_failures = if(isnull(sub_failures),"0",sub_failures Here's the search I have so far that will either return the sum of all failed login events, or the "No results found" message: index=infrastructure I want this to display a 0 as it is much easier on the eye (you know there were no results as opposed to thinking "did my search fail?"). However, when there are no events to return, it simply puts "No results found" or "N/A". I have this panel display the sum of login failed events from a search string. I am trying to make it so that when a search string returns the "No Results Found" message, it actually displays a zero.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |