index=app_xxxxxxxxx_products cluster_name=dxx-exx-awslab sourcetype=xxxxxxx:deployment-info | stats count by sourcetype
returns count for the sourcetype but when ran as :
index=app_xxxxxxxxx_products cluster_name=dxx-exx-awslab | stats count by sourcetype
the results doesn't include the sourcetype mentioned in firsts query
↧