My search sting is like:
host=A|rename "ERC" TO EMPLOYERCODE|join EMPLOYERCODE [search host= B|rename EMPLOYER_CODE TO EMPLOYERCODE ]|timechart span=1d sum(Visits) AS Visit, count(USER_NAME) AS User by EMPLOYERCODE| eval avg=Visit/User|table _time,avg.
My purpose is to generate a timechart with avg in y axis.
I am unable to display the avg in timechart. I am getting blank in average when using the above.Can you help me.
The table
call at the end is weird. Let's convert this to a simple, run-anywhere example:
index=_internal | timechart bins=20 sum(bytes) as Visit count(user) as User | eval avg = Visit/User | fields - Visit User
This works for me, fills the column avg
and removes the other two columns.
foreach solved my problem.
Thanks ,Let me try for each.
Ah, I missed that. In that case you don't have fields called avg and User but rather (I guess) some_employer: avg
and some_employer: User
. If that's the case, foreach is your friend - exact syntax depends on what fieldnames you have after the timechart.
The solution woks fine if we doesn't use by EMPLOYERCODE.
I need the result of sum and visits grouped by EMPLOYERCODE.