I have seen two other related questions but neither of the answers have worked for me.
Events with a controller_node and an execution_node (controller node is blank if run locally on execution_node).
id, controller_node, execution_node
Trying "...|eval controller_node=coalesce(controller_node, execution_node|stats count by controller_node" should return:
However, I am only getting:
I don't think the eval is working as expected. I also tried to do "...|fillnull value=execution_node controller_node" to no avail.
What is the correct way to evaluate if controller_node is null on each event and set the null value to the value of execution_node unique to each event?
... View more