I am using two spl which the result are different, but I think the spl is the same. Can anyone help?
index=main sourcetype=access_combined_wcookie
|stats values(useragent) as "Agents Used" count as "Times Used" by useragent
|table "Agents Used", "Times Used"
index=main sourcetype=access_combined_wcookie
|stats values(useragent) as "Agents Used"
|stats count("Agents Used") as "Times Used" by "Agents Used"
|table "Agents Used", "Times Used"
The result is attached.
... View more