Use _count as column (subquery)

Comments

2 comments

  • Avatar
    Kevin Keech

    The following query should help give you what you are looking for and does not require a subquery operation. 

    _sourceName = abc 
    | parse "msgid= *" as msgId
    | timeslice 1h
    | count by msgId, _timeslice
    | _count as cnt
    | count by _timeslice, cnt
    | transpose row _timeslice column cnt
    0
    Comment actions Permalink
  • Avatar
    Shraddha Mantri

    It worked. Thank you!

    0
    Comment actions Permalink

Please sign in to leave a comment.