I have created a dashboard that is monitoring the number of events received at corporate to the number of events reported on a client's database. This way we can be alerted when we have not received all events and can log into the client's database and manually pull that file. Here's a partial screenshot of the current dashboard: Here is the search that produces the above dashboard: | makeresults
| fields - _time
| eval eventName="CustCkIn,CustCkOut,EduAssigned,EduView,FTGChannelOff,NavHdiInteractive,PatientInfo,SncChromecastState,StayIdCrossReference,SurveyResponse,SysConfigRoomInfo,"
| makemv delim="," eventName
| mvexpand eventName
| append
[| inputlookup EventValidationMonitoring.csv
| addinfo
| eval _time=strptime(date,"%Y-%m-%d")
| where _time>=info_min_time AND _time<relative_time('info_min_time',"+604800") AND propertyId=0123456
| eval ValidationData=mvappend("nVerify=".nVerifyEvents,"nProperty=".nPropertyEvents,"nReceived=".nReceivedEvents,"Missing=".Missing)
| table date eventName ValidationData
| eval {date}=ValidationData
| fields - date ValidationData ]
| stats values(*) as * by eventName
| fillnull value="Missing=Undetermined, nProperty=NA, nReceived=0, nVerify=0" Is there a way I can format the fillnull string so that it has the same format as the other cells?
... View more