I am trying to build single value visualisation using search & sub search, But it is not working.earliest=-60m latest=now index=XXXXXX Successfull Logins where like(sourcetype, "XXXXXX") | stats count as Total |
↧