Got a search like this (I've obfuscated it a bit)
| tstats count where index IN (index1, index2, index3) by _time , host | where match(host,"^.*.device.mycompany.com$")
Got a great looking stats...
See more...
Got a search like this (I've obfuscated it a bit)
| tstats count where index IN (index1, index2, index3) by _time , host | where match(host,"^.*.device.mycompany.com$")
Got a great looking stats table - and Im really pleased with the performance of tstats - awesome.
I want to graph the results... easy right? well no - I cannot for the life of me seem to break down a say, 60 minute span down by host, despite the fact I got this awesome oven ready totally graphable stats table
so I am trying
| tstats count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")
| timechart count by host
but the count is counting the host, whereas I want to "count the count" ? Any ideas? this will be a super simple one I expect - I got a total mental block on this