Hello,
Is it possible to create a request in which we ask to give the top requested URL for each IP.
Something like :
index="cisco" | foreach src_ip [stats count by cs_url_host]
Hi @HouriaHal,
did you tried with the chart command?
something like this:
index="cisco" | chart count OVER src_ip BY cs_url_host
Ciao.
Giuseppe
