Im running this query:
host="forward*" count
| eval platform_800_count = ASICM_count_DN_800 + DF2_count_DN_800 + DF2_count_TT_800
| timechart max(coin_ENEC_count_DN_800), max(ASICM_count_DN_800), max(DF2_count_DN_800), max(DF2_count_TT_800), max(platform_800_count)
I expect eval to sum the fields into platform_800_count and as a last step to timechart this field but it does not present a value on the chart for platform_800_count.
Other fields are presented.
As Martin points out below I cannot eval seperate events, is there another method to do this?
... View more