Hello, I am trying to add another index column to this table. Currently using the search below. | tstats count where index IN (network) by _time span=1h | rename count as Network_Logs | eval _time=strftime(_time, "%m-%d %H:%M") | tstats count where index IN (network, proxy) by _time span=1h | rename count as Network_Logs | eval _time=strftime(_time, "%m-%d %H:%M") Adding another index such as proxy doesn't seem to work just adds to the total count. Is there anyway to count separate indexes by 1 hour intervals?
... View more