Hi,
I have the following search:
| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon
The result is displayed in a single value visualization with a trend. I want to round the result off to the nearest million.. Any thoughts on how to do this?
Thanks
You could do something like this:
| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=round(count/1000000)*1000000
You could also do this, but it might break your trend line:
| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=tostring(round(count/1000000))." M"
Give this a try
| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=round(count/1000000)*1000000
You could do something like this:
| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=round(count/1000000)*1000000
You could also do this, but it might break your trend line:
| tstats count WHERE index=test earliest=-2mon@mon by _time span=1mon | eval count=tostring(round(count/1000000))." M"