
It depends on what the actual query is, but a count() by is just that - it counts how often there is a message for this field. So if you click on the magnifying glass and get 53 messages, then things work as intended from a Logpoint perspective, and the same log message was generated 53 times in the same second at the source.
Obviously there could be minute differences between them, or the aggregation is on a field where it doesn’t make much sense.
2 comments