sourcetype="nswebapplog" (src_ip!=192.168. AND src_ip!=10.0.) status=200 useragent!="-" | lookup geoip clientip as src_ip | chart count by useragent1 client_country | addtotals | sort - Total | fields - Total | head 20
However If I do it like this it will prevent from drill down because of post process like eval or Addtotols.
Do anyone know how I can make stacked chart that I can drill down while still limit to top 10 or 20 output?
asked 29 Jun '11, 23:42