Hi. I have two field Single Value. First is using search:
Second is using search:
First search when not find any result display "0" in the SingleValue field. Second search when not find any result display "N/A". Could you help me to fix it? I need value "0" in second search too.
asked 03 Jun '12, 10:39
SingleValue has a number of odd corner cases where it displays "N/A" when 0 would be better. For instance if you're using postprocess, but the base search has 0 rows, it'll say "N/A". And that's even if the postprocess is something like "stats count", where it should thus say "0".
I think what's happening here, is that there are no values of
This would mean that in the case where the 'watchless events' are the only events there, at least a 0 will make it through the whole search pipeline.
Here is an updated search that should work even when you have no events at all matched in the initial search. I apologize but I assumed in my initial answer that you did have events returned consistently for 'index=mail watchdog', but that there was not always a 'watch' value extracted.
Anyway, here is the more robust form of the same idea. This search is resilient to the case when it matches no events at all.