Just upgraded SH from 7.0.2 to 7.2.5.1 (indexers still in progress) and some reports which rely on `_txn_orphan` broke. If I understand correctly, this should be returning the `_txn_orphan` field.
`| makeresults | eval foo="start;stop;start" | eval start_stop=split(foo,";") | mvexpand start_stop |fields - foo | transaction _time startswith="start_stop=start" endswith="start_stop=stop" keepevicted=true keeporphans=true unifyends=true`
↧