How do you create a stats count after aggregating multiple fields into one? Example: Given the following table: index saddr daddr A 10.0.0.1 192.168.1.8 A 10.0.0.1 192.168.1.9 How can I get a table like the following? index addr count A 10.0.0.1 2 A 192.168.1.8 1 A 192.168.1.9 1 ... View more

Is it possible to use different timeframes with different indices? For example: (index=index_a earliest="30/01/18:00:00:00" latest="30/01/18:00:05:00") OR (index=index_b earliest="30/01/18:10:00:00" latest="30/01/18:10:05:00")) dest_ip="10.0.0.1" What is the right way to do this? ... View more