Help on basic questions about a by clause

[jip31]

hi

sorry for this question but I have difficulties to understand why a by clause with 3 conditions retrieve less events than a clause with 2 events

Is the difference is on the field _time?

| stats count as PbPerf by _time toto tutu

| stats count as PbPerf by _time toto

 thanks

[smurf · Accepted solution]

Hi,

fields in the by clause cannot be empty. If it is empty, it does not show up in the results.

Try using fillnull before running the stats command like this:

| fillnull tutu value="n/a"