index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log" MessageType != "NULL" | timechart span=1d count by MessageType limit=0
I've tried to eval my counts of several different message types by 2 but it's not working. Any suggestions? I've worked around this issue by using a stats count instead of a timechart but I would like to figure this out within a timechart.
I have 2 answers.
This is how you can achieve the same thing:
index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log" MessageType != "NULL" | timechart span=1d count by MessageType limit=0 | foreach * [eval <<FIELD>> = if((isnum($<<FIELD>>$)), $<<FIELD>>$/2, $<<FIELD>>$)]
This is how you can do exactly what you asked:
index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log" MessageType != "NULL" | eval half=1/2 | timechart span=1d sum(half) by MessageType limit=0
This is what I ended up doing but I want to time chart instead.
index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log" MessageType = "PostCommunicationContact" OR MessageType="GetCommunicationContactsRequest" OR MessageType="charter.enterprise.deletecontactpoints.request" OR MessageType="charter.enterprise.SaveContactDataByValue.request" OR MessageType="charter.enterprise.findEventCommunicationByApplicationIdAndServiceEventId.request" OR MessageType="charter.enterprise.findUIEventFamilyByApplicationID.request" OR MessageType="charter.enterprise.findContactsByAccountNumberAndBillingSystem.request" OR MessageType="charter.enterprise.getcommpreference.request" OR MessageType="charter.enterprise.getcontactpoints.request" OR MessageType="charter.enterprise.savecommpreference.request" OR MessageType="charter.enterprise.deletecommpreference.request" | stats count by MessageType | eval count=count/2 | eval count=round(count)
I have 2 answers.
This is how you can achieve the same thing:
index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log" MessageType != "NULL" | timechart span=1d count by MessageType limit=0 | foreach * [eval <<FIELD>> = if((isnum($<<FIELD>>$)), $<<FIELD>>$/2, $<<FIELD>>$)]
This is how you can do exactly what you asked:
index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log" MessageType != "NULL" | eval half=1/2 | timechart span=1d sum(half) by MessageType limit=0
This works great! What's the best way to get rid of the decimal places? Eval round?
Yes, that's the way to do it.