Hmm. Here is one way:
index=_internal
| top limit=2 sourcetype
| append [ search index=_internal | rare limit=2 sourcetype ]
Hmm. Here is one way:
index=_internal
| top limit=2 sourcetype
| append [ search index=_internal | rare limit=2 sourcetype ]
thx aljhonson
np @sfatnass