This is related to my DNS index. I need to search all names that start with wpad and to list all the values found.
I did this using the command
"index=dns* quest_name="wpad* | stats values(quest_name) AS WPAD
An excerpt of the results is shown below
What I need is to compute the number of times each of the preceding values, say "wpad.NGIT.Northgrum.com", appears in the search. Can it be done using a single search? Thank you.
Having a count for each one of the quest_name values is the 1st step. I now need to compute the percentage of each of the computed quest_name count against the total count of all quest_name.
I can try
index=dns quest_name=wpad* | stats count(quest_name) AS Total count by quest_name AS WPAD
But this does not work.
How can these computations be done with one single search?