Here is my SPL query, index=wf_eit_ecio) | eval lstUlid=max('Properties.Gems.DataSyncsExecutionContext.dataSyncProvidersExecutionGroupULID') | where 'Properties.Gems.DataSyncsExecutionContext.dataSyncProvidersExecutionGroupULID' = lstUlid | chart count(Properties.Gems.DataSyncExecutionContext.DataSyncProviderName) as TotalApiCallsCount Over Properties.Gems.DataSyncExecutionContext.DataSyncProviderName lstUlid field is generated but its not working in where condition and not filtering the records
... View more