Thank you nick,
the problem is that in "foo" and "bar" we are using a "rename" function.
This is because foo search, without rename function, returns (EG) the following fields:
A, B
The bar search (without rename) returns:
A, C
We have to count by B in the foo search and by C in bar search, and then filter where count is > of 10.
Something like this:
"(foo | rename B as D) OR (bar | rename C as D) | stats count by D | where count>10"
but whe I use rename on a search that is the put in OR with another, I received a
"Error in 'UnifiedSearch': Unable to parse the 'unbalanced parentheses' search." ERROR.
Any idea about how can we do a
"(foo | rename B as D) OR (bar | rename C as D) | stats count by D | where count>10"
search?
Thank you
... View more