I am using this Search String to return results for specific user accounts:
search index=summary user_id=****** | search x_webcat_code_full!=Advertisements | stats sum(duration) as browsing_time by dest_domain _time user_id x_webcat_code_full duration | fieldformat browsing_time = tostring(browsing_time,"duration") | table _time, dest_domain, x_webcat_code_full, user_id, browsing_time
I am looking to aggregate the results by destination domain, and show an aggregate number for each domain by browsing_time and show a count. So instead of showing:
google.com 2mins
google.com 1min
google.com 5min
It would show only
google.com 8mins Count 3
Thanks for any help...
... View more