SPL
Original posted in 2015 Testing an issue with brackets
Description
The following search was copied from 2015:
0 0
index=_internal earliest=-48h latest=-24h | bin _time span=10m | stats count by _time | eval window="yesterday" | append [ | timechart span=10m sum(count) by window]
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.