This is probably simple. I am trying to add a row to stats/chart which displays the total number of events with a unique ID garnered using:
eventstats dc(UniqueID) as MyTotal
The stats will be something like:
search CurrentStatus=Status1 OR CurrentStatus=Status2 | stats count by CurrentStatus
Depending on whether you want a distinct count over all events or per CurrentStatus
, use either of these:
CurrentStatus=Status1 OR CurrentStatus=Status2 | stats count dc(UniqueID) as MyTotal by CurrentStatus
CurrentStatus=Status1 OR CurrentStatus=Status2 | eventstats dc(UniqueId) as MyTotal | stats count first(MyTotal) as MyTotal by CurrentStatus
I am looking for the total of all events regardless of status and then the total of those just with those stati. There are many other stati, but I am showing those stati in relation to the total.