Hello,
We have developed a dashboard to monitor the source of attacks.
The dashboard works fine, however, referring to the image on the left, when I hover over the indicator, it displays the count. How can I modify the search to capture the count as displayed on right?
Below is my query.
index="qradar_offenses"
| spath
| iplocation src
| geostats count by src
Thanks in advance