hello,
This is my search:
source=tcp:5555 PURCH_DAY=06-14 PURCH_DATE=19 PURCH_MIN>44 | stats count by ID_CARDHOLDER| sort - count | where count>=5|rangemap field=count severe=10-50 elevated=3-9 default=low
My problem is that I don't able to count the number of lines that my search returns. I want to apply my rangemap on the number of lines but I don't know how I can do it because I try count(_raw) but I don't use it correctly I think.
Thx by advance,
Laura
... |stats sum(linecount) AS MyTotalLines | ...
/kristian
No, I want to count the total lines that my search returns, not indivduals raw events.
Number of lines in what? Individual raw events? Have you checked the linecount
property?