I have the following query used to build a chart. Sometimes, the incoming events do not have the fields set. How could these events with null could be excluded in a Subsearch?
index=prod
| search processRelevantFields.processName="SessionExecution"|search prod.customerId=* prod.productId=*
| timechart dc(customer.ciamId) as "Active Users"
I have tried with "search <fieldName> =*" as given above. But this is not working. Please guide on how this could be implemented?
In what way is it not working?
Have you tried including the filters on the main search?
index=prod processRelevantFields.processName="SessionExecution" prod.customerId=* prod.productId=*
| timechart dc(customer.ciamId) as "Active Users"
The Main search is a complex base search query. The Subsearch is used to filter out the elements for this specific chart.
The result includes events which has null fields
OK try putting the field names containing dots in single quotes
index=prod
| search 'processRelevantFields.processName'="SessionExecution"|search 'prod.customerId'=* 'prod.productId'=*
| timechart dc(customer.ciamId) as "Active Users"