I modified your search a bit and with the search below, I get results up until I add in the |where clause. Also, I was able to remove the coalesce as the host field in both searches is the same (no need for ComputerName).
index=wineventlog (EventType=4 EventCode=13 host!=DL*) OR (EventType=4 EventCode=1100 host!=DL*)
| eval EventCodeFromOS=if(EventCode=13, 1, 0)
| eval EventCodeFromLoggingService=if(EventCode=1100, 1, 0)
| stats values(EventCodeFromOS) as EventCodeFromOS, values(EventCodeFromLoggingService) as EventCodeFromLoggingService by host
| where isnotnull(EventCodeFromLoggingService) AND isnull(EventCodeFromOS)
Without the where clause 30 day results of stats look like this:
host EventCodeFromOS EventCodeFromLoggingService
ABC 0 0
DEF 0 0
GHI 0 0
Any thoughts on where clause issue?
Ultimately, if there is a Logging service event but no OS shutdown event, I want to generate an alert.
... View more