Perhaps this is what you want?
... | stats sum(duration), count by origin
If not, please provide a few sample events, and a simple sketch of the desired output
/K
Perhaps this is what you want?
... | stats sum(duration), count by origin
If not, please provide a few sample events, and a simple sketch of the desired output
/K