Like this: | eval F1 = substr(F2,1,1) ... View more

Thanks! the second one works perfectly! ... View more

If you need the 10 most recent events by index, you can do this: index=* | streamstats current=t count by index | where count<=10 | stats list(_raw) by index ... View more