I'm using
index=main earliest=-1d@d latest=@d | stats distinct_count(host) by host | addcoltotals fieldname=sum | rangemap field=sum
in an attempt to get a count of hosts in to a single value module on a dashboard. Using this search, I get the name of the first host in the single value module.
I don't see why you are using a command that complex, or why you're using rangemap at all. (And in general, rangemap is a terrible command. If you need the functionality, eval
's case()
function is better in every way.) Why not just:
... | stats distinct_count(host) as hostcount
and then just display the hostcount
field in your singlevalue
I don't see why you are using a command that complex, or why you're using rangemap at all. (And in general, rangemap is a terrible command. If you need the functionality, eval
's case()
function is better in every way.) Why not just:
... | stats distinct_count(host) as hostcount
and then just display the hostcount
field in your singlevalue