I am trying to use fillnull_value with Tstats like it is stated in the documentation, but it is not working as desired as it's not giving null values.   | tstats summariesonly=true allow_old_summaries=true fillnull_value="NULL" count FROM datamodel=Linux_System.Linux_System  WHERE (Linux_System.src_host=*) by src_host ... View more

I am trying to fill the null values and using a datamodel. I want to use tstats and fill null values will "Null" using fillnull. How should I use it with tstats?  ... View more

Hi, I am using 2 indexes (index1 and index2). I want to pull a field from index1 (URL and rename it to url_1), and the in a subsearch I want to pull more fields from index 2. At the end I want a table with the field from index1(url_1) and the fields from index2.  ... View more

I am trying to create a search in which I'm using 2 different indexes, and want to produce and combined result as a table. The table should have some fields from both the indexes. There is one filed in both the indexes, with the same name, so I can't pull results from that field. index 1 has a filed called URL and index 2 has a filed also called URL. I want to change the name of the field in one index, eg: URL to URL_1 for index 1. ... View more