I have a subsearch that returns me the delta between two events. The problem is, sometimes the two events I´m looking for don´t exist. This results in the following Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'.
The subsearch looks like this:
| eval DisruptionInSeconds = [ my subsearch that returns the delta between two events
| sort - _time
| stats sum(timeDeltaS) as search | eval search ="\"".search."\"" ]
If these two events don´t exist, the search should return 0 (not NULL). How do I do that?