Hi, I have a question about MARS queries: I run queries using 'custom columns' and I continually hit over 5000 entries. I was wondering if there is a way to show the following:
- event type set
- source IP address
- destination IP address, port, and protocol
- <NEW FIELD> 'Hit-count'
The reason I posit the 'Hit-count' field is that this would help me see everything that happened on the first three columns and not limit me when MARS says 'only the first 5000 entries will be displayed'.
If there is any way to count the number of times it happened in a hit-count field, versus counting the number of times it happened and then limiting the displayed results, I would think that would be tremendously useful.
Please let me know if there is already a way to do this, or if there are any plans to add this! Thanks!