index=sonicwall_coverage earliest=0 latest=now
| where scope_id="sonicwall-20261107-v6"
| stats sum(raw_records) AS raw_records sum(raw_expected_records) AS raw_expected_records sum(targeted_messages) AS targeted_messages sum(excluded_records) AS excluded_records sum(unrecognized_records) AS unrecognized_records sum(normalized_matches) AS normalized_matches sum(timestamp_gaps) AS timestamp_gaps sum(mapping_gaps) AS mapping_gaps sum(manifest_gaps) AS manifest_gaps sum(binding_not_applicable) AS binding_not_applicable sum(h1_gap) AS h1_gap sum(h2_gap) AS h2_gap sum(h3_gap) AS h3_gap sum(h4_gap) AS h4_gap BY snapshot_id coverage_source
