How to combine events which got generated in a specific span?

[kranthimutyala]

Hi Team,

Im trying to combine events which are generated in a specific span of 1hr and show the count as 1 instead of the actual count. I tried with a bucket and its clubbing them the count is still not coming to 1.
Irrespective of how many events has been geenrated for a specific condition in a span of 1hr I want to keep it as count 1. Can someone help on how to achieve this .Thanks

[ITWhisperer]

Please share the search you have tried to solve this, preferably in a code block (use the </> formatting button)

[kranthimutyala]

index = abc Environment = "PROD" ProcessName = "*"  LogType = "*" TaskName = "*Main*" (LogLevel=ERROR OR LogLevel=FATAL) | bucket _time span=2h |stats count by _time TaskName

[ITWhisperer]

Your stats command is counting the events in the pipeline and creating stats events - try counting these stats events with the same by clause

index = abc Environment = "PROD" ProcessName = "*"  LogType = "*" TaskName = "*Main*" (LogLevel=ERROR OR LogLevel=FATAL) | bucket _time span=2h |stats count by _time TaskName |stats count by _time TaskName