I don't need to use streams, I just do whatever search I what, then in the 'Search Results' on the right, click on the + to the left of 'source' and press the 'quick values' button. You can export that to a dashboard, too. My dashboard has a number of these. (I just wish the dashboard version had the clickable magnifying glass to make searching for #1 easier.)
On Friday, April 10, 2015 at 4:41:33 PM UTC-5, Mark Moorcroft wrote: > > > This is probably a dumb newb question, but at this moment it's not obvious > to me. If I have a saved search like: > > "dropping event" AND "queue is full" > > Is it possible to see the list of "Sources" with the number of logged > events per source ONLY, instead of 10 pages of results? I guess you could > call that a "summary". It's often the case I don't care about the details. > I'm just in a hurry to go look at the clients in question so I just want to > see which ones are spitting out the messages. > > Part of the problem is probably that I have yet to embrace Streams because > it's really not clear to me how they work. > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
