Is it possible to get search results in a table when only some of the results will have all the fields associated with them?
Currently I cannot get this to work.
For example....
Date | Time | User | URL | Term | Product |
---|---|---|---|---|---|
15/05/2013 | 10:01:02 | User123456 | /Home/ | - | - |
15/05/2013 | 10:01:32 | User123456 | /Products/ | - | - |
15/05/2013 | 10:01:53 | User123456 | /Products/Product1/ | - | ID12345678 |
15/05/2013 | 10:02:42 | User123456 | /Search/ | - | - |
15/05/2013 | 10:03:12 | User123456 | /Search/Results/ | Car | - |
I usually use eval to handle these. Something like:
...my search params... | eval TermProduct=if(isnull(TermProduct),"None",TermProduct) | ...other search params...
then adjust your search to account for "None" (or whatever you want to eval it to) in that field.
fillnull?
... | fillnull value="-" Term Product | ...
You need fillnull before your stats command, not after.
If in my search query I use the below...
stats count by Date Time User URL Term | Fields Date Time User URL Term | fillnull value="-" Term
This will only return the last result on the above table. The previous 4 results do not have the field "Term" associated with them, however I would like these to populate with a blank if that is the case.