I'd like to be able to search for the following:
1) timechart over X days for the sum of the count of a field
2) spikes or % increase for the sum of the count of a field compared to previous hour, day, week, etc
For example, we are ingesting Palo logs and I'd like to be able to see what fields have the highest sum/total for the time period I run and then also see the % increase/decrease of the sum/total for the field as well compared to an hour/day/week/etc.
Not looking to break the count of the field using 'BY', but just interested in the sum/total of all events for a field
Pipe the results of your query to "fieldsummary", which by default provides both "count" and "distinct_count".
I think this will get you the data you're after, based on your question.
See this documentation for more detailed explanation: