i have the following log data coming in from our spam filter.
ndrscore=0 suspectscore=3 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 adjustscore=0 adultscore=0
i have the fields extracted and now i'm trying to report on them.
how do i create a search to summarize the different types of categories and the count of their values in buckets of 10.
i tried a few things, but nothing it giving my what i'm looking for.
Give this a try
your base search | table ndrscore suspectscore malwarescore phishscore bulkscore spamscore adjustscore adultscore | eval temp=1 | untable temp score value | stats count by score
OR
your base search | table ndrscore suspectscore malwarescore phishscore bulkscore spamscore adjustscore adultscore | eval temp=1 | untable temp score value | bucket span=10 value| stats count by score value
What is the desired output? Can you share a mockup?