Hi,
I want to shown the Total as 0 if username in lookup table has not event log . Using the fillnull value , it does not shown the results.
index=main sourcetype=oracle_ ACTION_NAME=LOGON [inputlookup testconn|fields username]|stats count AS Total by user |fillnull value=NULL
How to go changing it ? Would appreciate any advise.
↧