I have a column of seconds, some of which are negative (representing an outage). I want to use tostring(duration, "duration")
on the column, but that doesn't work
| stats count | eval count=-5 | eval duration=tostring(count, "duration")
Absolute the duration in the conversion and prepend it with a - or empty string.
| stats count | eval count=-5 | eval duration=if(count<0, "-", "") + tostring(abs(count), "duration")
Absolute the duration in the conversion and prepend it with a - or empty string.
| stats count | eval count=-5 | eval duration=if(count<0, "-", "") + tostring(abs(count), "duration")