I'm trying to search two different fields and I'm trying to combine the search with "AND" but it doesn't seem to work.
EX:
host="sf9012.com" | chart count(eval(NOT byte_range="0-0") AND eval(NOT download_agent="Mozilla")) AS Initiated
I want it to return "Initiated" but I get an error or invalidity.. I'm pretty sure, the use of AND is the problem. Anyone know how AND is properly used? and how I can achieve the intended search? Thanks!!
host="sf9012.com" | chart count(eval(NOT byte_range="0-0" AND NOT download_agent="Mozilla")) AS Initiated
host="sf9012.com" | chart count(eval(NOT byte_range="0-0" AND NOT download_agent="Mozilla")) AS Initiated
it's working!! hmm,... I swear I tried that .___.
THANK YOU!!