I have a query which can give DIfferent IPS that are hitting to the top URI's
source= some source 404 | stats count values(Real_IP) as Real_IP by URI | sort - count
I want to know out of these given IP's which IP occurred how many times in the same formate and in the same query
source= some source 404 | stats count by URI Real_IP | sort - count
It looks good but through this Query i will not get the URI no of occurrences as in my search query i was getting is there any way this query can fit in my search query
Totals as an extra column on each row
source= some source 404 | stats count by URI Real_IP
| eventstats sum(count) as Total by URI
| sort - Total