Hi,
I tried search some data from logs using this statement:
index=* sourcetype="mySource" Types* | stats count by Types
in result I receive table like this:
Type1 | 5 |
Type2 | 4 |
Type3 | 1 |
I know that in the future in logs can occur Type4 so I would like to add it in to serach result by force. I tried some lookup stuff but i cant use it properly to get expected result.
So for now I would like to have table like this:
Type1 | 5 |
Type2 | 4 |
Type3 | 1 |
Type4 | 0 |
Thanks in advice for help.
Hi @mikroice90 .. maybe, check this idea -
EDIT - using eval, we can check if type4 exist, if its null, assign a zero value.
index=* sourcetype="mySource" Types* | eval type4=if(isnull(type4),0,type4) | stats count by Types
Hi @mikroice90
the if condition is checking if type4 is null, then it adds type4=0, if it is not null, then it will take the current value of type4.
Brilliant, thanks a lot
One more question, This strings "Type1,Types2" etc. exist in more than one field in data set. Is it possible to count it all together instead of counting only by Types?