Hi.
My search which I want to count by eventtype has a stat for "eventtype=err0r". When I try to exclude it, the counts for the other event types are incorrect, even if I explicitly add the eventtypes of interest in the search.
search | stats count by eventtype
Does anyone have thoughts on this?
Thanks
↧