| eventcount summarize=false index=* index=_* | dedup index | fields index