Hi all,
I have a bit complicated question.
I tried to use "tstats count" command to check if there are events in a DM and because of the time range, the query took very long (a lot of events exist in the DM). I couldn't find any way to stop the tstats when the command finds even 1 event, except for head, which is not useful because it only affect when tstats is done.
So, I changed it to a from command, with head but the problem with that was to configure time range from within the query (as done with tstats "where earliest "...)
Can anyone help me find a way to stop tstats after it reach to specific count, or alternatively to use from with time range (within the query).
I am really out of ideas regarding to this...
Thanks a lot!!
