I have the following search based on this i just want to see unique values for the search
index=one eventtype=one_tu | sort -time, ComputerName | dedup id |stat dc(id) as ID | search open=false | table Date, ComputerName, agentName, class,Content,id
Never use sort without a number. There is no need to use both; try this:
sort
index=one eventtype=one_tu | sort 0 -time, ComputerName | dedup id | search open="false" | table Date, ComputerName, agentName, class,Content,id
View solution in original post
