Forum Discussion

Pawel_Giza's avatar
Pawel_Giza
Copper Contributor
Jan 10, 2022

KQL - when no result from query put 0 instead of message "No results found from the specified time"

Hello,

I have a query that checks how many logs appear in log analytics but when are no logs I need 0 value but there probably is null.  I need two information numbers of logs and the name of the device. What the correct query should look like?

 

Heartbeat
| where TimeGenerated > ago(12h)
| where Computer contains "devicename"
| summarize Count = count() by Computer
| project Value = iff(isnull(Count), 0, Count), Computer

 

 

1 Reply

  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    Jan 11, 2022
    Heartbeat
    | where Computer contains "devicename"
    | make-series count() default=0 on TimeGenerated from ago(12h) to now() step 1h by Computer

Resources