I'm not able to rename file names to display in a pie chart...any help would be appreciated...
I tried both ways..
index=web_server sourcetype=web_access (file="pr.prod" OR file="cr.crt" OR file="src.jsp") SESSIONID!="-" | dedup SESSIONID | stats count by file | rename "pr.prod" AS "Products", "cr.crt" AS "Category", "src.jcp" AS "Search"
index=web_server sourcetype=web_access SESSIONID!="-" | dedup SESSIONID | stats count(eval( file="pr.prod")) AS Products, count(eval(file="cr.crt")) AS Category, count(eval(file="srchjsp")) AS search | stats count by file
↧