KQL - when no result from query put 0 instead of message "No results found from the specified time"

Copper Contributor

Hello,

I have a query that checks how many logs appear in log analytics but when are no logs I need 0 value but there probably is null.  I need two information numbers of logs and the name of the device. What the correct query should look like?

 

Heartbeat
| where TimeGenerated > ago(12h)
| where Computer contains "devicename"
| summarize Count = count() by Computer
| project Value = iff(isnull(Count), 0, Count), Computer

 

 

1 Reply
Heartbeat
| where Computer contains "devicename"
| make-series count() default=0 on TimeGenerated from ago(12h) to now() step 1h by Computer