I initially created a chart that will show log count for a number of hosts: ... | chart count by host source | ... which would show the logs based for each separate host (first image) but I wanted it to only display when the counts don't match.
After some testing, I can produce a table that will display three columns per host when the counts don't match: ... | stats count as num_source by host source | eventstats values(num_source) as num_counts by host | where mvcount(num_counts)>1 | table host num_source | ... (second image), but now it displays the host for each column and are all one colour which isn't clear. Is there a way I can use the chart command so it's similar to the first image but with the data of the second? Thanks.
...
| stats count as num_source by host source
| eventstats values(num_source) as num_counts by host
| where mvcount(num_counts)>1
| table host source num_source
| chart sum(num_source) as count by host source
...
| stats count as num_source by host source
| eventstats values(num_source) as num_counts by host
| where mvcount(num_counts)>1
| table host source num_source
| chart sum(num_source) as count by host source