This doesn't solve the issue ... View more

Managed to solve this problem by adding index=win* | stats count by src dest action | rename count as realCount | appendpipe [stats sum(realCount) as count by src dest | rename src as source, dest AS target] | appendpipe [stats sum(realCount) as count by dest action | rename dest as source, action AS target] | search source=* | fields source target count ... View more