index=* | stats count by _raw, index, sourcetype, source, host | where count>1
0 comments
[1]
[0]
[1]
[0]
index=* | stats count by _raw, index, sourcetype, source, host | where count>1
[1]
[0]