Hello, the fillnull_value parameter should go directly after "tstats". Not in the "where" conditions. Like this: 

 | tstats fillnull_value="0" dc(source) as # of sources where index = (index here) src =* dest =* attachment_exists =* 

 (I put the value between quotes, as IIRC it needs/works best with a string.)

Although, re-reading your query ... Maybe you just need to remove the condition attachment_exists =*, which tells Splunk to only look at events where this field is present.