Comments

2 comments

  • Avatar
    Harinder Bhandari

    Hi Jellou,

    You can sort by timeslice, field 1, field2, field3 like this:

    | timeslice 1h
    | parse field1
    | parse field2
    | parse field3
    | count by _timeslice, field1, field2, field3
    | sort by _timeslice


    Hope this helps.

    Thanks.

     

    0
    Comment actions Permalink
  • Avatar
    Jellou Mae Infante

    Hi,

    I was able to do that. However, im getting some error upon implementation of outlier with that.

    0
    Comment actions Permalink

Please sign in to leave a comment.