I am trying to filter out null values from the result of stats. Query looks like below.
index=someindex* some
((somefield1=value1 AND somefield2="value2")
AND (somefield1=value3
OR (somefield2=value4
AND somefield1=value5
)
)
)
OR (somefield1=value6)
| eval someeval=...
| replace "some*" with "SOME" in somefield1
| bucket _time span=1d as daytime
| stats max(eval(if(somefield1=value1,_time,null()))) as val1_time
min(eval(if(somefield1=value2,_time,null()))) as val2_time
min(eval(if(somefield1=value3 ,_time,null()))) as val3_time
by somefield3 somefield4
| eval recovered_time=if(isNotNull(val2_time),val2_time,val3_time)
| where isNotNull(val1_time)
But this query returns result with null or empty val1_time also.
What could be the issue in this query? I further pass the result of this query to another stats query. But I am stuck here.
Adding this line in the end does the magic.
| where isNotNull(val1_time) AND val1_time != ""