Is there a way to account for null/zero values that show up when you run a match window?
For example this query -
ingestion.log_type != ""
$log_type = ingestion.log_type
match:
$log_type
outcome:
$event_count = sum(ingestion.event_count)
$event_type_count = count_distinct(ingestion.event_type)
$event_types = array_distinct(ingestion.event_type)
order:
$event_count desc
Gives results back like the following
log_type - Test
event_count - 4
event_type_count = 3
event_types - USER,,EDR
as you can see it accounted for the zero value but I do not want it to account for the empty value in that count for event_type_count