I have a search that looks like:
multisearch [search a] [search b] | table field1, field2, field3 | fillnull value="N/A" | outputlookup lookup_table | tscollect namespace="Foo"
When I input the lookup table, a whole bunch of fields still have null values. If I look at the same data using `tstats`, those fields have the "N/A" like they are supposed to.
Can anyone explain why this is happening?
Thx.
↧