index..... | stats latest(...) latest(....) latest(....) by ..... | rename latest(*) as * | eval eaten_90d = case(isnull(daysSince), null(), daysSince < 90, 1, 1=1, 0) |eval eaten_30d = case(isnull(daysSince), null(), daysSince < 30, 1, 1=1, 0) |eval eaten_60d = case(isnull(daysSince), null(), daysSince < 60, 1, 1=1, 0) | stats dc(....) as Donuts sum(....) as Disabled sum(eaten_90d) as 90d_eaten sum(eaten_30d) as 30d_eaten sum(eaten_60d) as 60d_eaten by ... Donuts | lookup ..... id as ..... OUTPUT...... | lookup .... OUTPUT ...... | search ..... | sort .... | search 90d_eaten=0 AND 60d_eaten=0 AND 30d_eaten=0 | stats sum(Donuts)
... View more