Hi, I have json data structured as follows:     { "payload": { "status": "ok", # or "degraded" } }     I'm trying to use the stats command to count the "ok" and "degraded" events separately. I am using the following query:      index=whatever | eval is_ok=if(payload.status=="ok", 1, 0) | stats count as total, count(is_ok) as ok_count     I have tried passing it through spath, , with "=" in the if condition,  and several other approaches changes. What always happens is that both counts contain all elements, despite there being different numbers of them. Please help! ... View more