Description
SET unmapped_fields="nullify";
from alerts*
| keep kibana.alert.risk_score
| FORK (where true | mv_expand kibana.alert.risk_score) (where true | SAMPLE 0.7762696917404431)
| stats kibana.alert.risk_score = count(*)
| eval x = least(kibana.alert.risk_score, 52, 60)
| keep kibana.alert.risk_score
leads to
Column [kibana.alert.risk_score] has conflicting data types in FORK branches: [NULL] and [DOUBLE]",
while removing the SAMPLE branch from the FORK leads to a different exception:
SET unmapped_fields="nullify";
from alerts*
| keep kibana.alert.risk_score
| FORK (where true | mv_expand kibana.alert.risk_score)
| stats kibana.alert.risk_score = count(*)
| eval x = least(kibana.alert.risk_score, 52, 60)
| keep kibana.alert.risk_score
Found 2 problems
line 2:98: Plan [MvExpand[kibana.alert.risk_score{f}#2112,kibana.alert.risk_score{r}#2113]] optimized incorrectly due to missing references [kibana.alert.risk_score{f}#2112]
line 2:84: Plan [Project[[kibana.alert.risk_score{r}#2113]]] optimized incorrectly due to missing references [kibana.alert.risk_score{r}#2113]",
Description
leads to
while removing the
SAMPLEbranch from the FORK leads to a different exception: