I would like to search for events by certain fields, and the field may or may not exist. I want to show all results and if the field does not exist, the value of which should be "Null", and if exists, the value should be displayed in the table.
Example:
| tstat count WHERE index=cartoon channel::cartoon_network by field1, field2, field3, field4
however, field4 may or may not exist. The above query returns me values only if field4 exists in the records. I want to show results of all fields above, and field4 would be "NULL" (or custom) for records it doesnt exist.
Could you please help?
... View more