hi
I want to do a count the last event of a subsearch
I am doing "stats count last" but it doesnt works
what I have to do please? Something with _time?
`test`
[| inputlookup host.csv
| table host
| rename host as USERNAME ]
| search Building = "X254"
**| stats count last(Building)**
↧