Hi everyone,
I am currently trying to create a table that shows the count of activity by user as well as the occurrence in which sourcetype:
What I am trying to achieve
Users | Sourcetype | Count |
User 1 | source 1 | 20 |
User 2 | source 2 | 30 |
Here is my base search at the moment:
index=index* "user"="user1*" OR "user"="user2*" | stats count by user | eval input_type="Count"| xyseries input_type count
Right now, it does show me the count of the user activity but I'm not sure how to add the sourcetype to the search to create a table view.
Just add "sourcetype" to the stats command.
index=index* "user"="user1*" OR "user"="user2*"
| stats count by user, sourcetype
Just add "sourcetype" to the stats command.
index=index* "user"="user1*" OR "user"="user2*"
| stats count by user, sourcetype
Thank you! I didn't realize how simple the solution was haha