Need some help adding a 0 count at search time.
I have a log that contains the execution duration of a code function.
Using stats I can count the number of times the function took
I would like to show a count of 0 for the missing functionDuration times.
I searched around and couldn't find answer. Thanks for any help.
asked 09 May '12, 18:36
It would be nice if you could just have a command called like
However we can hack one together ourselves using a search for the 1000 most recent events in the last 30 days.
The basic idea is, use our weird subsearch hack to append 1000 rows, with every functionDuration value from 1-1000 represented. Then when we wash the original "real" events together with the fake events, through `| stats sum(count) as count by functionDuration), suddenly we'll have every functionDuration value from 1-1000 represented...
1) Instead of the weird