...search
| stats count(tile) as launches by tile publishId
| sort -"launches"
accountExId: 12345678
publishId: 63020U or 63020S
tile: Tile1
How do I get results so that it will look similiar to this:
publishId tile launches
*S Tile1 4
Tile2 6
Tile3 8
publishId tile launches
*U Tile1 8
Tile2 1
Tile3 10
Try this
...search
| stats count(tile) as launches by tile publishId
| sort -"launches" by publishId
| stats list(tile) as tile list(launches) as launches by publishId
Thanks for the quick response!!! This is close but I'm looking to sort on publishId=*U and *S....just the aggregate of those two.
Currently: I have multiple publishId's..
publishId tile launches
1d Tile1 5
2y Tile2 8
3r Tile3 3
4h Tile4 1
...etc
Desired result:
publishId tile launches
S Tile1 25
Tile2 58
Tile3 63
Tile4 81
publishId tile launches
U Tile1 35
Tile2 98
Tile3 63
Tile4 21