I am trying to include logic ,so that it can handle No results found .
When No events found ,the following returns 9.
When Events Exist the final field loses its scope after stats .
| eval final = if(count=0,9,final) :- Here the final field becomes inaccessible.
| eval final = if(status_="exist", 0, 1)
| stats count
| eval final = if(count=0,9,final)
| table final
To make final field accessible after stats , i used | stats count by final .
This created additional problem, when the events are present, | stats count by final fails.
| eval final = if(status_="exist", 0, 1)
| stats count by final
| eval final = if(count=0,9,final)
| table final
... View more