I have the following query:
fields @timestamp, status, requestId
| filter message like 'RoutesHandler invoked.'
| parse request /(?<version>\/(v\d\.\d\.?\d?)\/)/
| stats count(version) as apiVersion by version
| sort @timestamp desc
| limit 2000
Commenting out the stats part I will receive something like:
So, some have a version, some not.
Now, when I add the stats line I also would like to have the "no version found" counted. However, I'm only getting the results stats for entries which have a version parsed.
How can I retrieve "no value" as a stat?