This should be so simple but I cannot get it to work. I am trying to create a panel that will display a table with three columns:
THREAD TYPE COUNT
the search should find the count of each thread and group it by type. for example:
THREAD TYPE COUNT
A searcher 10
B grouper 20
A compiler 2
C searcher 5
Meaning each thread can have different types:
sourcetype="thread.stats" | chart count by thread_id | sort -count by thread_id,type
any help appreciated
hI jdepp,
try
sourcetype="thread.stats" | stats count by thread_id, type | sort -count
It's not clear the sort order.
Bye.
Giuseppe
sourcetype="thread.stats" | stats count by thread_id type| sort - count
try that
thanks. Both of you answered almost at the same time. Really appreciate it. But have to go with cusello as he was first by seconds.
hI jdepp,
try
sourcetype="thread.stats" | stats count by thread_id, type | sort -count
It's not clear the sort order.
Bye.
Giuseppe
thanks. Both of you answered almost at the same time. Really appreciate it.