Describe the bug
unroll pipe, prior to stats pipe throws an error
_stream:{"fedr.Message Type" in (${type:doublequote})}
| fedr.Classification:(${classification:doublequote}) AND fedr.Action:(${action:doublequote}) AND fedr.Severity:(${severity:doublequote}) AND $Logsql
| unroll rule.name
| stats by (rule.name,fedr.Severity) count() results
| sort by (results) desc
| limit 10
error: the pipe `| "unroll by (rule.name)"` cannot be put in front of `| "stats by (rule.name, fedr.Severity) count(*) as results"`, since it modifies or deletes `_time` field
(Trace ID: e4b36d42ebd8905631723e09e9481577)
rule.name is an array of values [value1,value2,...]
This type of query had been working on previous versions, 1.2X...
To Reproduce
run unroll prior stats pipe
Version
v.1.33.1
Describe the bug
unrollpipe, prior tostatspipe throws an errorrule.nameis an array of values[value1,value2,...]This type of query had been working on previous versions, 1.2X...
To Reproduce
run unroll prior stats pipe
Version
v.1.33.1