How to have stats with no result found

[pbd]

Hi,

I'm looking at logs on a Gateway to see if there is traffic or not for specific files at a specific time.
I want to show the status of the flow.

The file has to be present only on Monday between 5:30PM and 7:30PM.
If it is then the state is "OK" and "KO" if not.
If we are another day and there that is no traffic, it's "Not expected"
Otherwise, it's a warn.

Could you please help ?

Here is my command line :

eventtype=echanges IDF="KB0N3A*" OR IDF="N70N3A*" ENDTIME>"17:30:00" ENDTIME<"19:30:00" RECEPTEUR="FGPXYG00" STATUS="COMPLETED" VOLUMETRIE>0 | stats count as Nb by IDF,date_wday | eval State = if(Nb == 1,if(match(date_wday, "monday"),"OK","Warning"),if(match(date_wday,"monday"),"Warning","Not Expected")) | table State

[somesoni2 · Accepted solution]

Give this a try

eventtype=echanges IDF="KB0N3A*" OR IDF="N70N3A*" ENDTIME>"17:30:00" ENDTIME<"19:30:00" RECEPTEUR="FGPXYG00" STATUS="COMPLETED" VOLUMETRIE>0 
| stats count as Nb by IDF,date_wday 
| appendpipe [| stats count as Nb| where Nb=0 | eval date_wday=lower(strftime(now(),"%A"))]
| eval State = if(Nb == 1,if(match(date_wday, "monday"),"OK","Warning"),if(match(date_wday,"monday"),"Warning","Not Expected")) | table State

[pbd]

Thank you very much!!!!

[pbd]

I think I've finally found !!! \o/

eventtype=echanges IDF="KB0N3A*" OR IDF="N70N3A*" ENDTIME>"17:30:00" ENDTIME<"19:30:00" RECEPTEUR="FGPXYG00" STATUS="COMPLETED" VOLUMETRIE>0 | stats count as Nb by IDF,date_wday | appendpipe [| stats count as Nb| where Nb=0 | addinfo | eval date_wday=lower(strftime(info_min_time,"%A"))] | eval State = if(Nb == 1,if(match(date_wday, "monday"),"OK","Warning"),if(match(date_wday,"monday"),"Warning","Not Expected")) | table State date_wday Nb

[pbd]

Thank you for the fast reply !
This would be perfect if I can replace "now()" in the strftime function by the time i'm searching for ?
You put me on the right track I think.