Hi Folks,
I want to produce a count of events in each of my indexes. Where there isn't any data for the time range I specify in my search, I want to return 0 next to the corresponding index. So far I've tried;
index=blah* |timechart span=5m count by index | append pipe [stats count | where count==0]
The above returns 0 - but how can I add in the corresponding index name that has 0?
thx!
R
... View more