I have seen two other related questions but neither of the answers have worked for me. Data: Events with a controller_node and an execution_node (controller node is blank if run locally on execution_node). id, controller_node, execution_node 1,a,b 2,,a 3,,a 4,,b 5,,b 6,,b 7,b,a 8,,a Trying "...|eval controller_node=coalesce(controller_node, execution_node|stats count by controller_node" should return: a: 4 b:4 However, I am only getting: a:1 b:1 NULL:6 I don't think the eval is working as expected. I also tried to do "...|fillnull value=execution_node controller_node" to no avail. What is the correct way to evaluate if controller_node is null on each event and set the null value to the value of execution_node unique to each event? ... View more