It worked and exactly what I looking for. There is no depth limit, but at least its predictable value and I do a finite amount of iterations that would cover the task.. Thanks! ... View more

Would probably be better if you did this instead: index="weblogs" [ SEARCH index="custcomplaintlogs" earliest=-1d | append [earliest=-1s |stats count | eval custsession=if(isnull(custsession,"null",custsession) | fields custsession]| return 50 $custsession ] or index="weblogs" [ SEARCH index="custcomplaintlogs" earliest=-1d | append [earliest=-1s |stats count | fillnull custsession | fields custsession]| return 50 $custsession ] ... View more