how to merge two sourcetype for coverage dashboard ( one gets count increase and other will have decrease in count )

[dtccsundar]

I am using below query,

index=A sourcetype IN (Compare,Fire)| fillnull value="" | search Name="*SWZWZQ0001*" OR Name="*SADAPP0002*" OR Name="*SALINU0016*" OR Name="*SGGRNP1002*" | stats values(*) as * by sysid |eval Status=if(F_Agent_Version ="" AND C_Agent_Version ="","Not Covered","Covered") | table sourcetype sysid Name F_Agent_Version C_Agent_Version Status

sourcetype	ITAM_sysid	ITAM Name	Fire Agent Version	Compare Agent Version	Status
Compare      Fire	0003fb	SALINU0016	32.30.	6.3	Not Covered
Compare                    Fire	003fcb	SGGRNP1002	29.7		Not Covered
Fire	0d456	SADAPP0002	32.3		Covered
Compare	0d526	SWZWZQ0001			Not Covered

 Due to the null's in the first and second rows (SALINU0016,SGGRNP1002) for Agent_version and Compare Agent Version , i am getting not covered instead of covered.Please let me know ,how to get rid of nulls and make the status Covered .

[ITWhisperer · Accepted solution]

Try with the fillnull after the stats

index=A sourcetype IN (Compare,Fire)
| search Name="*SWZWZQ0001*" OR Name="*SADAPP0002*" OR Name="*SALINU0016*" OR Name="*SGGRNP1002*" 
| stats values(*) as * by sysid 
| fillnull value="" 
| eval Status=if(F_Agent_Version ="" AND C_Agent_Version ="","Not Covered","Covered") 
| table sourcetype sysid Name F_Agent_Version C_Agent_Version Status

[dtccsundar]

This worked Perfectly . Thank You !!