Here is a screenshot of what I do.
How can I remove null fields and put the values side by side? I am using stats table group by _time to get all the metrics but it seems that metrics are not indexed at the same time and result in blank fields. How can I resolve this issue? Thanks
The easiest way is to "fudge" the time a bit like this:
Your Original Search up until the stats command here | bucket _time span=5m | stats first (*) AS * BY _time
If you still see some NULL values, keep bumping up 5m
until you don't.
The easiest way is to "fudge" the time a bit like this:
Your Original Search up until the stats command here | bucket _time span=5m | stats first (*) AS * BY _time
If you still see some NULL values, keep bumping up 5m
until you don't.
how does _time look in the above table? you can bucket the events into a specific time range before you do stats . This way all events within that time period are grouped together. Example below which groups all the events in a 5 min window
.. | bucket _time span=5m | stats..