Single value return N/A instead of 0

SingleValue has a number of odd corner cases where it displays "N/A" when 0 would be better. For instance if you're using postprocess, but the base search has 0 rows, it'll say "N/A". And that's even if the postprocess is something like "stats count", where it should thus say "0".

I think what's happening here, is that there are no values of watch defined, so stats count by watch is an empty result set. You can sort of repair this by having

index=mail watchdog | rex field=_raw "From = \"watchdog@(?<watch>.*) " | fillnull watch value="no_watch_value" | stats count by watch | stats max(count) as lista | eval count=if(watch=="no_watch_value",0,count) | rangemap field=lista low=0-4 default=severe

This would mean that in the case where the 'watchless events' are the only events there, at least a 0 will make it through the whole search pipeline.

---UPDATE ------

Here is an updated search that should work even when you have no events at all matched in the initial search. I apologize but I assumed in my initial answer that you did have events returned consistently for 'index=mail watchdog', but that there was not always a 'watch' value extracted.

Anyway, here is the more robust form of the same idea. This search is resilient to the case when it matches no events at all.

index=mail watchdog | rex field=_raw "From = \"watchdog@(?<watch>.*) " | fillnull watch value="no_watch_value" | stats count by watch | stats count max(count) as lista | fillnull lista value="0" | eval count=if(watch=="no_watch_value",0,count) | rangemap field=lista low=0-4 default=severe