NO RESULTS from the following:
| tstats summariesonly=false count FROM datamodel=Web WHERE (Web.action=*block*) by Web.action, Web.host, Web.src, Web.dest |rename Web.* as *|table action, host, src, dest
Results from this:
| tstats summariesonly=false count FROM datamodel=Web WHERE (Web.action=*block*) by Web.action, Web.src, Web.dest |rename Web.* as *|table action, src, dest
Creating Pivot from the same Web datamodel displays host results:
| pivot Web Web count(Web) AS "Count of Web" SPLITROW dest AS Dest SPLITROW src AS Src SPLITROW host AS Host FILTER action is "block*" SORT 1000 dest ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1
We need the results from the datamodel to append to other results. Any assistance would be appreciated.
