index=* | stats count by _raw, index, sourcetype, source, host | where count>1
0 comments
[1]
[0]
[1]
[0]
index=* | stats count by _raw, index, sourcetype | where count>1 | stats values(sourcetype) as sourcetype by index
0 comments
[1]
[0]
[1]
[0]