Below is the query and a distinct on "Input_File_Status" or whatever will display within the query a distinct value.     index=us_gssas_dev_app sourcetype="sql:database" Bot_Name="LoyaltyWaiver" NOT Input_File_Name="" OR Item_Status="Success" OR Item_Status="Exception" OR NOT Item_Status=* OR Item_Status="" | stats count(eval(match(Input_File_Name,""))) as "Capacity" count(eval(match(Item_Status,"Success$$$$$$$$"))) as "Success" count(eval(match(Item_Status,"Exception$$$$$$$$"))) as "Exception" count(eval(match(Item_Status," "))) as "WIPF" count(eval(match(Item_Status, ""))) as "Processed" by Input_File_Name | eval Final_Processed=(Processed - WIPF) | eval WIP=(Capacity - Success - Exception) | eval Success_Percentage=(Success/Capacity)*100 | eval Success_Percentage= round(Success_Percentage, 0) | eval Success_Percentage = Success_Percentage + " %" | table "Input_File_Name" "Capacity" "Success" "Exception" "WIP" "Final_Processed" "Success_Percentage" ... View more

I'm trying to get a distinct count, but on the search query, but it's not giving me what I'm expecting to see. If I run this search I get total event count of 198, but when I add the dc, values, etc. it only displays 2. ... View more

Is there a way to rename the NULL to display something else?   ... View more