I have 10 indexes starts with "ep_winevt_ms" . So i am using * here "index=ep_winevt_ms*".
But while taking the | stats count i want only 1 count for the entire "ep_winevt_ms*". I don't want 10 count for "ep_winevt_ms*". Please help
| stats count will give you the count of events returned by the search of all the ep_winevt_ms* indexes.
Why do you think this is not the case?
ep_winevt_ms* - This index is mapped in Data Model Macros.
I want to exclude all other indexes in (ep_winevt_ms*) and take the count as 1 to know the unique indexes.
@ITWhisperer
| stats count by index | stats count
