Re: How do I know if I have multiple events

marianaduran · ‎09-24-2020

Because wc -l of the input doesn't match my event count, and I'm trying to troubleshoot.

thambisetty · ‎09-24-2020

look at field "linecount" in your events.

index=<yourindex> | where linecount>1

————————————
If this helps, give a like below.

richgalloway · ‎09-24-2020

Please describe the problem in more detail. What kind of events, how are you counting them?

---
If this reply helps you, Karma would be appreciated.

How do I know if I have multiple events