Hi the_wolverine
I'm pretty sure you can use this as a start and do some fancy stuff out of it:
| stats dc(*) as * by sourcetype
cheers,
MuS
Hi the_wolverine
I'm pretty sure you can use this as a start and do some fancy stuff out of it:
| stats dc(*) as * by sourcetype
cheers,
MuS