index=dns | chart sparkline AS Activity count AS "Number Transaction" by host | sort 10 -"Number Transaction" | rename host AS "Server IP"
This is what I have come up with so far...
| tstats summariesonly=t prestats=t count from datamodel=Network_Resolution by host | chart sparkline AS Activity count AS "Number Transaction" by host | sort 10 -"Number Transaction" | rename host AS "Server IP"
With this search everything works fine except for my sparkline.
↧