I'm very new to spiunk so bare with me. I'm trying to count the number of events on two seperate file paths and have them display in a table in sep fields. So far, I include FullFilepath="*:\*" and I exclude the particular paths I'm not interested in... for example.... FullFilePath!="E:\*" ...therefore in my search, I return a count of all filepaths that are not E.
What I would like to do is include the count for both E: file paths and non E:..but in seperate fields. Can anyone provide an example on how to do this? or a good direction? Thanks!
Like this:
... | stats count(eval(FullFilePath="E:*")) AS ECount count(eval(FullFilePath!="E:*")) AS OtherCount
Like this:
... | stats count(eval(FullFilePath="E:*")) AS ECount count(eval(FullFilePath!="E:*")) AS OtherCount
thanks a lot