Below is the log events that I have. One has max_amount value and one has empty value. I want to find out the events that have transaction_amount > max_amount.
[Date=2022-07-29, max_amount=100, transaction_amount=120]
[Date=2022-07-29, max_amount=100, transaction_amount=90]
[Date=2022-07-29, transaction_amount=120]
I tried transaction_amount>max_amount but not working. I guess it is due to some records having no max_amount value.
index=<table_name> transaction_amount>max_amount | bucket Date span=day | fillnull value=null max_amount | stats count by Date, max_amount, transaction_amount
How to get the record #1?
... View more