My search looks something like this:
index=name | eval request=case(X, Y, X, Y, X, Y) | stats latest(request) as Request | table Request
Whenever I run this I am getting blank output. I really need to solve getting this to run or an alternative to providing the latest event that passed the case criteria.
↧