Hello Is there any way to get a field that would just be the number of the event? like this? http://tinypic.com/r/2cbuxl/6 thanks
The only way I know is to do this: index=_internal | eval acc=1 | accum acc as event_number | table _time _raw event_number
index=_internal | eval acc=1 | accum acc as event_number | table _time _raw event_number
