I used the below query, here some applications are like appname and some like appname.application. So I added app1*,app2*,.... Now the counts are perfect and getting the duplicate application na...
See more...
I used the below query, here some applications are like appname and some like appname.application. So I added app1*,app2*,.... Now the counts are perfect and getting the duplicate application names. index="index1" ApplicationName IN (app1*,app2*,app3*,app4*,app5*,app6*,app7*,app8*,app9*) | chart count(ApplicationName) over ApplicationName by Status | addtotals | append [| makeresults | eval ApplicationName=split("app1,app2,app3,app4,app5,app6,app7,app8,app9", ",") | mvexpand ApplicationName | fields - _time ] | fillnull value=0 | stats max(*) as * by ApplicationName Can anyone please help me on this.