Hi all.
I wish to display in a table format the value's count.
For example;
Computer A has 100 sessions.
Computer B has 50 sessions.
I want to display the 100 and and the 50 values alongside "Computer A" and "Computer B".
Thanks!
Sounds like all you need is to add the following to your query:
| stats count by fieldnameWhere "fieldname" should be whatever field you want to see the counts of.
Alternatively, if you only want the top ten for example, you can also take a look at the top command
No, those are general example that express my search.
Let me explain more:
1. I have the fields inside "Interesting fields"
2. I select one - for example: "Username" - and click on it.
3. I get top 10 values with the used usernames and their count.
4. I wish to display in a table (or any other way) the count of the used usernames.
Hope this explains it better.
| stats count by username
Sounds like all you need is to add the following to your query:
| stats count by fieldnameWhere "fieldname" should be whatever field you want to see the counts of.
Alternatively, if you only want the top ten for example, you can also take a look at the top command
YES.
Thank you!
Are those examples of your events?
Do you have any fields already extracted?