Am trying to run a query where subsearch might return no results on some days. In such case i am trying to assign 0 values to calculate ratio, but its not returning any results.
index=main sourcetype="abc"
| eval date=strftime(_time, "%x")
| stats dc(uuid) as countA by date
| join _time [ search index=main sourcetype="abc" | eval date=strftime(_time, "%x") | search "error" | stats dc(uuid) as countB by date]
| eval Ratio=(countA/(countA+countB))
I have tried appending fillnull at the end of subsearch but it returns noresults.
got it:
index=main sourcetype="abc"
| eval date=strftime(_time, "%x")
| stats dc(uuid) as countA by date
| join _time [ search index=main sourcetype="abc" | eval date=strftime(_time, "%x") | search "error" | stats dc(uuid) as countB by date | appendpipe [ stats count | eval countB=0 | where count==0 | fields - count ] ]
| eval Ratio=(countA/(countA+countB))