I have a index that contains both destination and source countries in each entry.
I would like to get a list over top 10 countries, regardless of the source or destination.
I have tried something like this:
... | top limit=10 srccountry,dstcountry
But this doesnt work, since it shows top based on both source and destination.
Something like this I was hoping would work, but clearly doesnt
... | top limit=10 srccountry OR dstcountry
I was thinking that I could add the results from two searches and addning them, but not sure how to do this.
Does anybody knows how to solve this? (if possible)
You could do something like this:
your search | eval country = srccountry . ";" . dstcountry | makemv delim=";" country | mvexpand country | top country
That will make two events for each event, one with country=srccountry and one with country=dstcountry, and then count the top ten countries.
You could do something like this:
your search | eval country = srccountry . ";" . dstcountry | makemv delim=";" country | mvexpand country | top country
That will make two events for each event, one with country=srccountry and one with country=dstcountry, and then count the top ten countries.