Search --
|source1 | stats count(source1.field1) by (source1.field2) | sort 0 source1.field2
* Search Output
source1.field2 | count
dev | 6
prod | 5
uat | 7
qa | 8
* How can we add count values of 'prod' and 'uat' & also to display the field value as below , Is this doable ? *
source1.field2 | count
dev | 6
prod + uat | 12
qa | 8
↧