Hello,
I'm doing a table to summarize some data and I want the table show the column or the row even if a given field value is not found.
For example, I have the following search:
index=index (field1=value11 OR field1=value12) AND (field2=value21 OR field2=value22) | chart count over field1 by field2
and it gives me the following:
field1 value21 value22
value11 2 3
value12 0 1
which is what I want. But if I use a real-time window and an event with value12 doesn't occur, it gives me:
field1 value21 value22
value11 2 3
and I want it to show me:
field1 value21 value22
value11 2 3
value12 0 0
Is there any way to do that?
Thanks!
... View more