I have a table with say 5 columns. Each row contains the following: username, event, timegenerated, Hostname, IP and a severity level.
I want to make an extra column called "Count" that shows the amount of times the combination of Username and event appears in the table. But I want to keep seeing the other columns: Hostname, IP, severity level, timegenerated in the results.
When I try the following query: Summarize count = count() by event; It only shows the event column and the number of times it is in the table. If I add more columns after the "by" it will take those columns into the count function.