(host=pnr-proxy-prod* OR host=master*.menlosecurity.com* OR host=pnr-webui-prod*)
(level=* OR "error:" OR "warn:" OR "[warn]" OR "WARNING" )
| rex field=host "^(master-|safemail-)?(.*-prod-)?(?[0-9\-]+[0-9])"
| eval no_event= if((isnull(event) AND (level="ERROR" OR level="WARNING")) , _raw ,null())
| stats count(event) as count, count(no_event) by _time, event, no_event, level, source, ms_version
so my problem is that I need to display no_event in stats but every time I add no_event in stats nothing get returned. it works fine if a change the null value to a string
It seems all your events, that are fed to stats command, have no_event=null(), so when you include it in stats you get no results (trying to aggregate by something that doesn't exist). Using a string value to denote null (say NULL) in place of null() would be the way to go.