I have the following command:
sourcetype="sourcetype" eventid=731 OR eventid=730
| stats latest(eventid) by target
| chart count by eventid
the 2nd line works as expected, but when I add in the 3rd line, i get "No results found"
I want to display the results of the 2nd line in a pie chart rather than a table.
↧