hello
i have this query :
index="prod" eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared"
| stats count list(eventtype) by _time
the result im getting is :
_time count list(eventtype) 2019-08-05
10:24:23 5
csm-messages-dhcpd-send-socket-fallback-net
csm-messages-dhcpd-lpf-eth0-sending
csm-messages-dhcpd-lpf-eth0-listening
csm-messages-dhcpd-eth1-nosubnet-declared
csm-messages-dhcpd-write-zero-leases
what should i change in my query so i will see the count for each raw ?
thanks
Hi @sarit_s,
try something like this.
index="prod" eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared"
| timechart count BY eventtype
Choose the span you like.
Ciao.
Giuseppe
looks better but in the _time column it is showing only year and month, how can i show the all timestamp ?
also, i need to collect the events for each timestamp