|
Dear All sourcetype="nswebapplog" (src_ip!=192.168. AND src_ip!=10.0.) status=200 useragent!="-" | lookup geoip clientip as src_ip | chart count by useragent1 client_country | addtotals | sort - Total | fields - Total | head 20 However If I do it like this it will prevent from drill down because of post process like eval or Addtotols. Do anyone know how I can make stacked chart that I can drill down while still limit to top 10 or 20 output? |
Refine your search:
- Apps & Questions
- Apps
- Questions
- Users
- Tags
Markdown Basics
- *italic* or _italic_
- **bold** or __bold__
- link:[text](http://url.com/ "Title")
- image?
- numbered list: 1. Foo 2. Bar
- to add a line break simply add two spaces to where you would like the new line to be.
- basic HTML tags are also supported
Tags:
Asked: 29 Jun '11, 23:42
Seen: 964 times
Last updated: 29 Jun '11, 23:42