hi,
this is my query
index=tm_idx host="server" sourcetype="TM_Test_10"
| rex field=msg "(?i)TM1\sserver\sload\stime\s\(secs\)\s\=\s(?P<timetakentostart>\w+)"
| where timetakentostart!=""
| stats sum(timetakentostart),values(timetakentostart) by date_month
values
gives me unique value of the field but i want duplicates also. How can i get it ?
Thanks and Regards
Use list
instead of values
.