For some reason my |tstats count query is returning a result of 0 when I add an OR condition in my where clause if the field doesn't exist in the dataset, or if the OR condition specifies a string value when the value for the field in the data is always an integer. For example: This query returns the correct event count (or at least it's non-zero):   |tstats count where index="my_index" eventOrigin="api" (accountId="8674756857")     Adding this OR condition returns a count of zero -- why? Note that for this time range there are no events with a serviceType field, but for other time ranges there are events with a serviceType field.   |tstats count where index="my_index" eventOrigin="api" (accountId="8674756857" OR serviceType="unmanaged")     Adding this OR condition also returns zero -- why? It's true that accountId should normally be an integer, but it's an OR, so I still expect it to count those events.   |tstats count where index="my_index" eventOrigin="api" (accountId="19783038942" OR accountId="aaa")     Using a * results in the same non-zero count as the first query, which is expected, even though there are no events with a serviceType field:   |tstats count where index="my_index" eventOrigin="api" (accountId="8674756857" OR serviceType="unmana*")     Why would adding an OR condition in tstats cause the count to be zero? The same problem does not occur with a regular search query. I am on Splunk 9.1.0.2. ... View more