sourcetype="MFApps" | addtotals fieldname=sum |top limit=1 sum | fields + count | rename count AS "Number of Events
This is my search and all I want is one field that lists the total number of events. It does not seem to be keeping a sum of all events. Instead it just seems to be keeping the highest event number.
Use stats count.
sourcetype="MFApps" | stats count as "Number of Events"
Use stats count.
sourcetype="MFApps" | stats count as "Number of Events"