DA Dave Safian 4/18/2018 I prefer this query for efficiency. Substitute list of indexers into the query.\r\n\r\n| eventcount summarize=false index=* | search server= | dedup index | fields index | sort index Reply
Comments
1 total
I prefer this query for efficiency. Substitute list of indexers into the query.\r\n\r\n| eventcount summarize=false index=* | search server= | dedup index | fields index | sort index
Leave a comment
You must log in to post a comment.