Thank you so much!  ... View more

Thanks! I had some issues with the coalesce- was only CountA values. Tried doing this:   index=* sourcetype=_JSON logstreamName="*" OR logstreamName="*"   |stats count as total by FieldA | appendcols [ search index=* sourcetype=_JSON logstreamName="*" OR logstreamName="*" | stats count(eval(FieldB> 0)) AS total by FieldA] So I only want to interrogate the stats count of FieldA against values of FieldB that are greater than 0.   ... View more