Hi Everyone
I was wondering how I would go about a stats count for 2 fields where 1 field depends on the other.
So for example we have a field called service version and another called service operation. Operations aren't necessarily exclusive to a version but I was wondering if it was possible to do a stats count where it would display something like:
Service 1 - Operation 1: *how many* - Operation 2: *How many* and so on.
Is something like this possible?
The stats command can group results by multiple fields. Try
| stats count by Service,Operation
Do you mean something like this?
| stats count by Service, Operation