hi.
i have more 15 fields in my events with different field name.
ex:
field1 field2 field3 ... fieldn
i want do sum,avg or count of all my fields one time, how do it ?
i try this:
|stats sum(field1) sum(field) ...sum(fieldn) by User date_day
it is work but it is very laborious for me.
please help me.
try like this:
...|stats c(*) sum(*) avg(*) by User date_day
or
...|stats c(*) as count_* sum(*) as sum_* avg(*) as avg_* by User date_day
try like this:
...|stats c(*) sum(*) avg(*) by User date_day
or
...|stats c(*) as count_* sum(*) as sum_* avg(*) as avg_* by User date_day
thank you.