I want to get a table with two columsn. One with Name/label and a second with the counter for the name/label. The example has not the same columns/rows. It#s for illusration…
@Juergen That query looks completely different.
In that case, this should work.
slect dummyfield, count(dummyfield) from dummyindex group by dummyfield
This is my example executed on the security audit index.
select audit_transport_request_type.keyword, count(audit_transport_request_type.keyword)
from security-auditlog-2023.12.15
group by audit_transport_request_type.keyword