Hey all,
I am trying to show all iis errors separated by host over a 24 hour period. But, when I run the below command, it completes and says it has 200,000 plus results, but nothing shows up in the graph. Can anyone assist?
Thanks.
host="**" | chart list(host) over time by count(sc_status) span=1d
I was able to get the results I wanted by using the below command.
|bin _time span=1d | chart sum(sc_status) list(sort(sc_status)) by host,sc_status
I was able to get the results I wanted by using the below command.
|bin _time span=1d | chart sum(sc_status) list(sort(sc_status)) by host,sc_status
host="*" | bin span=1d _time| stats count(sc_status) as count by host sc_status
Thank you this gets me more than I was able to before. But the chart will only show one server. Is there a way to show all servers and separate the status by status type instead of total count