I'm very new to Splunk, and I'm trying to figure out a way to search by different top fields, depending on whether the first field exists or is not null. Let me try to explain... I have some data that comes in with different severities, and I've created an Extracted Field for an exception_type. The exception_type is only set on rows with a severity of WARN or ERROR. I'm trying to create a dashboard that I can filter using a dropdown by severity, and it will show a chart of counts of events broken down by exception type. If there are no exception types for that severity, I just want to show an overall count. I started with this, and obviously it doesn't work, but it might give an indication of what I'm trying to do: severity=$severity$ | eval if(isnotnull(exception_type),top exception_type,stats count as Total) showperc=0 Using "severity=$severity$ | top exception_type showperc=0", and selecting my DD, I get results for WARN and ERROR, but other severities show nothing. Thanks, I appreciate any help you can give! - Mark ... View more