hi
In my stats command, i need to filter the events by Model and by SITE
But once its done, I need to mask the fields SITE
So I am doing a `| fields SITE`but it doesnt works because I have double values in the Model field because its possible to have a same Model for two different sites
What I have to do please??
| stats values(MODEL) as Model, count(DegradationTime) as DegradationTime by host
| stats count(host) as "Number of degradation" by Model SITE
| sort -"Number of degradation"
| fields - SITE
↧