chart count(IN), count(OUT), count(EXP) by SERVER
I also want to include the calculated value of count(IN)-count(OUT)-count(EXP) on the column chart. How can I include that calculation?
Thanks!
I can't try it right now but it probably looks like this:
<search> | stats count(IN) as inCount, count(OUT) as outCount, count(EXP) as expCount by SERVER | eval calcField = inCount - outCount - expCount | chart inCount, outCount, expCount, calcField by SERVER
I can't try it right now but it probably looks like this:
<search> | stats count(IN) as inCount, count(OUT) as outCount, count(EXP) as expCount by SERVER | eval calcField = inCount - outCount - expCount | chart inCount, outCount, expCount, calcField by SERVER
Thanks. That way works!