I have a basic SPL using mstat but I can't use treills with it? Any ideas why I can't select "severity"
| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" BY severity
in the end i needed to add a stats to the end of my SPL to get this to work
| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" mx.env=dell967srv.scz.murex.com:15016 BY severity
| rename count as ErrorCount
| rename severity as lvl
| stats sum(ErrorCount) as Count by lvl
| sort - ErrorCount
in the end i needed to add a stats to the end of my SPL to get this to work
| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" mx.env=dell967srv.scz.murex.com:15016 BY severity
| rename count as ErrorCount
| rename severity as lvl
| stats sum(ErrorCount) as Count by lvl
| sort - ErrorCount