Hi,
I'm inserting an appendpipe into my SPL so that in the event there are no results, a stats table will still be produced.
However, I am seeing differences in the field values when they are not null. Can anyone explain why this is occurring and how to fix this?
Well if you want to display the Tier for which the events are not available OR has no count, I think append pipe or append column will not help you.
But as you are doing transpose and fields in you further searches I would like to suggest you below search.
YOUR_DATAMODEL_SEARCH
| stats count as averageResponse by Tier
| eval averageResponse=round(averageResponse,3)
| transpose 0 header_field="Tier"
| eval _time=now()
| fields unaithenticated,highPriority,lowPrioriy,unattended,largePayload _time
| fillnull value=0.000 unaithenticated,highPriority,lowPrioriy,unattended,largePayload
My Sample Search :
| makeresults | eval Tier="unaithenticated,highPriority,lowPrioriy",Tier=split(Tier,",") | stats count as averageResponse by Tier
| eval averageResponse=round(averageResponse,3)
| transpose 0 header_field="Tier"
| eval _time=now()
| fields unaithenticated,highPriority,lowPrioriy,unattended,largePayload _time
| fillnull value=0.000 unaithenticated,highPriority,lowPrioriy,unattended,largePayload
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
have you tried appendcols ?
Using appendcols, there are still differences
lowPriority, unattended, and largePayload still differ from the values when not using an appendcol/appendpipe