This resulted in all bluescreened values to = 0. Table appeared as pc_connection | Pc_id | bluescreened lan | 1234 | 0 All (3) events fields do show values and the result should be 46 for bluescreened. What else can I try? ... View more

Guess i don't have enough Karma to post SS yet. But here is the fieldsummary. field count distinct_count values status 27673 9 [{"value":"200","count":24013},{"value":"503","count":680},{"value":"408","count":528},{"value":"406","count":493},{"value":"404","count":491},{"value":"500","count":490},{"value":"400","count":480},{"value":"505","count":346},{"value":"403","count":152}] categoryId 12013 8 [{"value":"STRATEGY","count":3237},{"value":"ARCADE","count":1894},{"value":"ACCESSORIES","count":1483},{"value":"NULL","count":1431},{"value":"TEE","count":1426},{"value":"SIMULATION","count":1028},{"value":"SHOOTER","count":980},{"value":"SPORTS","count":534}] AcctID 21313 500 [{"value":"1010558415713236","count":1},{"value":"1011101960657692","count":1},{"value":"1012823059693579","count":1}, ------plus a bunch more---- In short, trying to find out count of status=400 by catergoryId. Was trying to use AcctID to tie events together but not getting results expected ... View more

I reconfirmed spelling (i usually copy/paste from clicking filed and grabbing the header), verbose on as well. This was the results categoryId count(AcctID) 400 ACCESSORIES 0 1483 ARCADE 0 1894 N/A 21313 277 NULL 0 1431 SHOOTER 0 980 SIMULATION 0 1028 SPORTS 0 534 STRATEGY 0 3237 TEE 0 1426 Any other ideas? I'll post screenshot of fieldsummary below. ... View more

Made this change { index=main ("categoryId=" OR "AcctID=" AND status=400) | stats count(AcctID) count(status) as status by categoryId } Now the results show tabled like categoryId count(AcctID) status NULL 0 224 What else could be wrong that the catergoryId are showing as NULL and AcctID =0? ... View more