How do I combine a field with similar value (where one value might or might not exist in one of the field) and use stats by with an uncommon field? I have the search below
| tstats prestats=t summariesonly=t allow_old_summaries=t count from datamodel=Network_Resolution.DNS by "DNS.query"
| rename DNS.query as query1
| tstats append=t prestats=t summariesonly=t allow_old_summaries=t count from datamodel=Web.Web by _time Web.dest Web.category
| rename Web.dest as query2
| rename Web.category as category
| eval query=coalesce(query1,query2)
| stats count by query category
| fillnull value=NULL
| Web.dest | Web.category | DNS.query |
| abc.com | News | abc.com |
| | | dfe.com |
Results:
Expected Results:
| query | category |
| abc.com | news |
| dfe.com | NULL |
