I have a filed in my logs "labeDatal" and I also have another field that I trace out called "labelDataSpec"
i.e. log => ".....labelData="whatever1" labelDataSpec="whatever1.1"
How can I run a query that just brings back data for labelData and not labelDataSpec? The following query is bringing back data for labelDataSpec as well (I only want labelData):
source=...labelData| chart count by labelData | sort count | reverse
output example:
labelData count
1 whatever1 15
2 whatever2 100
etc,...
Your stats should work like it is - have you verified your data? Anyway, you can remove the field before the stats/chart/timechart/whatever, just to be sure ...
your search | fields - labelDataSpec | chart count by labelData | sort - count
/K
Your stats should work like it is - have you verified your data? Anyway, you can remove the field before the stats/chart/timechart/whatever, just to be sure ...
your search | fields - labelDataSpec | chart count by labelData | sort - count
/K