I have a source with 100,000 events. For an Interesting field "action" where it has value as "purchase" with a count of 21,000. I want to make use of stats command with count function to see the count of events in my event list.
I tried this but it is not accepting.
index="main"
| stats count(action) =" purchase" as "Total count of Purchase occurences"
What is the correct syntax, please?
@palisetty
Try this.
index="main" | stats count(eval(action="purchase")) as "Total count of Purchase occurences"
@palisetty
Try this.
index="main" | stats count(eval(action="purchase")) as "Total count of Purchase occurences"
Thank You. It worked