Hello -
I have the following search:
<base search>
| fields host registrations
| stats latest(registrations) by host
This produces the following table:
host latest(registrations)
Pc1 51
Pc2 29
Pc3 18
How would I add the values of latest(registrations) to provide a single value for all 3 hosts? For example, I would like only the sum of the latest registrations (98) to display in a single value panel.
Thank you!
<base search>
| fields host registrations
| stats latest(registrations) as latest_reg by host
| stats sum(latest_reg) as total_latest_reg
<base search>
| fields host registrations
| stats latest(registrations) as latest_reg by host
| stats sum(latest_reg) as total_latest_reg
Thank you!! This worked for me.