I need help to append this rest command to my query. The problem is that the rest command is adding to the first row and I need it to be added to the row that was last entered. | rest /services/a...
...ictim. Rerun the transaction.",message)
| stats count by message
| append
[ stats count
| where count=0
| eval message="Transaction (Process ID XX) was deadlocked on lock resources w...
Hi All, I have the below search. I am being told it appends results to a lookup table called user_ids.
index=ad earliest=-15d
|stats latest(_time) as _time, latest(p...
...bserved unexpected behavior when testing approaches using | inputlookup append=true ... vs | append [| inputlookup ... ] . Here are a series of screenshots documenting what I found.
I created t...
I appended 2 searches and each of them has "top Engineer" and now my result is like this.
Engineer Escalated Closed
Shaun 61
Smith 53
Arun 41
Sam 19
J...