Hi,
My query is below -
index=abc sourcetype=xyz Unable to connect to the remote server | Stats count(eval("Unable to connect to the remote server")) as "Error" by host
In this query how can I use (timechart span=1h) function? Any suggestions would be appreciated..
Thanks
Your eval
is wrong and redundant; try this:
index=abc sourcetype=xyz Unable to connect to the remote server | timechart span=1h count AS "Error" by host
Your eval
is wrong and redundant; try this:
index=abc sourcetype=xyz Unable to connect to the remote server | timechart span=1h count AS "Error" by host
thanks... that's cool..