need help with showing eval in stats

[kiamco]

so I have this query

(host=pnr-proxy-prod* OR host=master*.menlosecurity.com* OR host=pnr-webui-prod*) 
(source=* source!="/var/log/pnr/pnr-policy-nginx-cache.log")
(level=* OR "error:" OR "warn:" OR "[warn]" OR "WARNING" )
| rex field=host "^(master-|safemail-)?(.*-prod-)?(?[0-9\-]+[0-9])"
| eval no_event= if((isnull(event) AND (level="ERROR" OR level="WARNING")) , _raw ,null())
| stats count(event) as count, count(no_event) by _time, event, no_event, level, source, ms_version

so my problem is that I need to display no_event in stats but every time I add no_event in stats nothing get returned. it works fine if a change the null value to a string

[somesoni2]

It seems all your events, that are fed to stats command, have no_event=null(), so when you include it in stats you get no results (trying to aggregate by something that doesn't exist). Using a string value to denote null (say NULL) in place of null() would be the way to go.

[MuS]

Hi there,

remove the last stats and see if your event and no_event fields are available in all events, as well check all other fields you use in the by clause of the stats

cheers, MuS