Hello Splunkers.
I have a data model that contains a multi value field, called acao.
Looking at the data model, I have the following:
When I run the following query: | tstats count(DM.acao) from datamodel="My_DataModel"
, the result is 2.
However, I want it to count all occurrences, resulting in 8 (1 P and 7 X's).
How can I do this?
Thanks.
Best Regards,
GMA
HI @guimilare,
Can you please try this?
| tstats count from datamodel="My_DataModel" by DM.acao | stats sum(count) as count
Thanks
| tstats dc(DM.acao)
?