0

I have the following query:

fields @timestamp, status, requestId
| filter message like 'RoutesHandler invoked.'
| parse request /(?<version>\/(v\d\.\d\.?\d?)\/)/
| stats count(version) as apiVersion by version 
| sort @timestamp desc
| limit 2000

Commenting out the stats part I will receive something like:

enter image description here

So, some have a version, some not.

Now, when I add the stats line I also would like to have the "no version found" counted. However, I'm only getting the results stats for entries which have a version parsed.

How can I retrieve "no value" as a stat?

agoldev
  • 2,078
  • 3
  • 23
  • 38

1 Answers1

0

Do count(*) instead of count(version). This should give you an empty value with a count.

You could also use the coalesce function to display something other than the empty value. Like this:

| parse request /(?<version>\/(v\d\.\d\.?\d?)\/)/
| fields coalesce(version, 'NO_VALUE') as final_version
| stats count(*) as apiVersion by final_version
Dejan Peretin
  • 10,891
  • 1
  • 45
  • 54