I have written this query: index=index_name (log.event=res OR (log.event=tracing AND log.operationName=query_name)) | timechart span=1m avg(log.responseTime) as AvgTimeTaken, min(log.responseTime) as MinTimeTaken, max(log.responseTime) as MaxTimeTaken count by log.operationName My results look like this: _time AvgTimeTaken: NULL MaxTimeTaken: NULL MinTimeTaken: NULL count:query_name count: NULL count:query_name 2024-03-18 13:00:00 0 0 0 I want to understand what the :NULL means, and also how I can get the query to display all values. Secondly, the count is getting displayed for query_name that is similar to the query_name in my query string. I wanted to get an exact match on the query_name. Can someone please help me with this? Thanks!
... View more