You can use eventstats:
index=_internal | eventstats max(date_second) AS MAX min(date_second) as MIN | table date_second,MAX,MIN
You can use eventstats:
index=_internal | eventstats max(date_second) AS MAX min(date_second) as MIN | table date_second,MAX,MIN
Hi mzorzi,
Thanks for your response.
I used eventstats but I also wanted to get values from the search and table them as well.
Do you know how?
Could you provide the search and if possible some sample data?