The search below looks for an event for a specific client during a specific time. If the event is not there, I would want to be notified, thus a "1" should be returned.
There is no event, so noNull is 0. The case statement "end" should be "1-0" (1-noNull), so 1 should be returned. However, I get "No results found." FYI: the search does work is noNull is 1.
source=*D:\\FHSO\\imports* source=*daily\\imports* End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| where ClientID="WHI"
| where ((like(source,"%"."WHI"."%")) AND time>"02:00:00" AND time<"02:25:00")
| stats count as lateEnds
| eval noNull = if(ISNULL(lateEnds),0,lateEnds)
| eval end = case(ClientID="WHI", 1-noNull ) | table end
Hi griffinpair,
try something like this
source="*D:\FHSO\imports*" source="*daily\imports*" End earliest=-30h@h ClientID="WHI"
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| eval isEvent=if(like(source,"%"."WHI"."%") AND time>"02:00:00" AND time<"02:25:00",1,0)
| stats count as myCount sum(isEvent) AS isEvent
| eval noNull=if(isEvent>0, isEvent, myCount)
| eval end = case(ClientID="WHI","1-"+noNull)
| table end
The main search is strange because you used two conditions for source connected by AND clause: running only the main search have you results?.
Bye.
Giuseppe
P.S.: add always index in your search, is quicker!
A couple of things:
| eval end = 1 - lateEnds