im trying to work with the job.resultCount token, but I can't really figure it out. I have this pretty basic search:
Its supposed to return the amount of login attempts, grouped by user and with more than 1 attempt per day. I display the result ( 0 ) as a SingleValue panel in my dashboard. Now I want to sump up this result and results from other SingleValue Panels into a new Panel, to see how many patterns returned at least one result. To get that information, I use the below code to set a token for each panel, which will be added up later.
Problem is, as the | stats count command creates a row displaying 0 results, its counts as a result and therefor the token is set to 1. I also cannot use job.eventCount as there may be single failed login attempts for a user.
Any ideas how I can bypass/solve this particular problem?