Dear Team,
I just want to use the simple search below to see which indexes are having zero count that day/week/whichever time period.
index= *
| stats count by index
| where count = 0
However, the search is not returning anything and if I remove the where count=0 it is only returning indexes with more than zero counts. How do I make sure that the indexes with count=0 are included?
Thank you.
Warm Regards.
index=*
| timechart span=1d count by index
| untable _time index count
| where count = 0