...an I display the number of failures, plus earliest(_time) and latest(_time) by src_ip
I've tried using streamstats like below, but do not get what I'm looking for
index=myIndex AND status=* | t...
I want a cumulative count of a field that has multiple values. Somehow this isn't working:
base search| streamstats count(State) as dur time_window=1w| timechart sum(dur) by State span=1w
...ame document_number. With streamstats I was able to fill them further (after found), but not backwards. Is it possible somehow? Or only if I do | reverse and apply streamstats again?
...F27461'
where TOMMYLE is the user and 'HttpSession created/destroyed' indicates when he logs in and gets logged out from the app. I could use some help probably with streamstats or something similar w...
I'm going to check the permission and rejection of the scan attack per hour. At this point, what I wrote... Which is appropriate, Vlaues or the list? Also, which one is suitable, stats or stream st...
Hi,
I'm using streamstats to calculate the median for a field and timechart to see the count of events where the field has a value less than a median.
... | streamstats median(bytes) as meby|e...
I have a query using streamstats that is on the intensive side because I'm not dealing with nicely-formatted data. (Legacy code FTW)
To help with performance, I added the fields command to e...
...bc On
Here I want to calculate "Number of Times State Went from On to Off" and "Number of Times State Went from Off to On" using streamstats command. In above case results will be-
source|d...