I have two fields, "sender" and "recipient". I want to create a table that lists distinct sender-recipient pairs and the corresponding # of events for each pair. I can't think of how to use stats dc or dedup to do this. Any ideas?
| stats count by sender recepient
or
| eval sender_recepient = sender."-".recepient | stats count by sender_recepient
How about this? This should give you "list of distinct sender-recipient pairs and the corresponding # of events for each pair"
YOur current search with field sender and recipient
| stats count by sender recipient
| stats count by sender recepient
or
| eval sender_recepient = sender."-".recepient | stats count by sender_recepient