I have the following query to display top 10 counts, for example:
sourcetype=IIS | top 10 URL
This returns the total counts of URL hits and percentage of the top 10 URLs. How can I show the unique/distinct counts in the column next to total counts?
Maybe something like -
sourcetype=IIS | stats count by URL, <sub URL field>
If you have a sub URL field, like domain for example...