My rule returns the value we expect (number of different "ip.src" that generated events of the type indicated in the "where" field). Is it possible to use this rule in a values-over-time chart to display the number of different ip.src in each time interval (5 min)? The rule is:
thanks
