Using case in an eval statement, with values undefined in the case function displayed in stats table as well.

[amcb90]

The command I am running is:

basesearch | eval number = case ( number = "1" , "Number 1" , number = "2" , "Number 2" , number = "3" , "Number 3" , number = "4" , "Number 4" ) | stats count by number

But when I run this I also want to display the values that are undefined in the eval line. How would one go about this?

[richgalloway]

Add an entry in the case.

basesearch | eval number = case ( number = "1" , "Number 1" , number = "2" , "Number 2" , number = "3" , "Number 3" , number = "4" , "Number 4" , 1==1, "undefined") | stats count by number