How do you record 0 (zero) results in a Sumo Logic log search?

Question

I'm trying to produce a dashboard for quick identification of system issues using Sumo Logic.

We currently log specific strings in our system when certain code paths are executed. For example:

def get_alerts():
    log.info(event=LogEvents.GET_ALERTS_STARTED)
 ...

In the case of potentially unwanted system behaviour we log inside blocks of business logic:

...

elif is_last_import_is_after_start_of_new_import_interval:
        log.warn(
            event=LogEvents.POTENTIAL_IMPORT_DUPLICATION,
            reason="last import occured after the start of the new import interval",
        )

...

The problem is that when there are no potentially unwanted system behaviours (such as no instances of POTENTIAL_IMPORT_DUPLICATION), the log line is never printed, so my query fails.

The query I'm using is as follows:

_sourceCategory=infosec/edr/logs/prod
| json "message" as msg
| json field=msg "message"
| count(message) by message
| if (message matches "POTENTIAL_IMPORT_DUPLICATION", _count, 0)

The final line here (if (message matches "POTENTIAL_IMPORT_DUPLICATION", _count, 0)), is my latest attempt to output 0 to the results table if no log messages match that string. Instead, the results table just fails to include the string:

Can anyone help me with getting an additional row in this table that would potentially read:

message	_count
POTENTIAL_IMPORT_DUPLICATION	0

Answer 1

You need to use the | fillmissing operator.

(Disclaimer: I am currently employed by Sumo Logic)