number of threads

[smolcj]

Hi all,
I have an eventtype called threads. how can i find the number of threads in it? suppose under eventtype threads i have
a1
a2
a11
a12
a111.. etc....
please help.. thank you for your time 🙂

[smolcj · Accepted solution]

search | stats dc(threads) AS count by eventtype

[Damien_Dallimor]

I don't totally comprehend your question.

Do searches like these help ?

eventtype="threads" | stats count

or to group the count by each thread(assumes those examples above are threadID's extracted to a field named threadID)

eventtype="threads" | stats count by threadID

[smolcj]

Thanks Damien