Is there a way to count events by the name of the macros matched?
Example, I have macros A
, B
, and C
.
Can I do a search of something equivalent to
`A` OR `B` OR `C` | stats count(macro_name)
?
Not that I know of. Macros gets interpreted into the search string, and their original identity is pretty much lost. Depending on the complexity of your macro, you could build eventtypes that match it (or even replace it?). Eventtypes do retain their identity through the search and would let you do this.
Not that I know of. Macros gets interpreted into the search string, and their original identity is pretty much lost. Depending on the complexity of your macro, you could build eventtypes that match it (or even replace it?). Eventtypes do retain their identity through the search and would let you do this.