Create a request with 2 reseach

[HouriaHal]

Hello,

Is it possible to create a request in which we ask to give the top requested URL for each IP.

Something like :

index="cisco" | foreach src_ip [stats count by cs_url_host]

[gcusello]

Hi @HouriaHal,

did you tried with the chart command?

something like this:

index="cisco"
| chart count OVER src_ip BY cs_url_host

Ciao.

Giuseppe