Is it possible to view events grouped by an indexed attribute?
Being able to view the data this way would allow me to quickly prioritize issues which are impacting the great number of users. Right now I accomplish this by creating multiple searches to isolate an individual issue and add it to the dash. I can then compare multiple issues over time on the dash to understand which issue may be transient and which needs my immediate attention. This requires a large amount of switching between windows and creation and deletion of dash items.
Being able to do this without taking all the extra steps of creating multiple queries would be great. Something like a query of GroupBy(IpAddress) and then rendering it in a stacked bar graph would be perfect.
Thank you,
Brian