Hi
I have a dashboard that displays the numerial value of a field called method_duration.
The value is in ms.
The search string I have looks like this:
index=bec_ci_prod ("deploy_status_type=info" "direction=exiting") | sort + method_duration | chart count by method_duration span=10000
The result from thus is actually as expected. But now I would like to show the method_duration in seconds and not in miliseconds
I then add this to the search string:
| fieldformat method_duration=round(method_duration/1000)
The result is that when listing the result several of the results now have the same value like 5-6 results showing 0 etc.
How could you get Spluk to show all the rounded numbers that end up being 0 in just one result ?
Also when i try to add the span=10 all the results values are blank but the count remains. I think it has something to do with the first problem where multiple results now sjhow the same value
Any idea how to solve this ?
Maybe, try eval round function -
| eval method_duration=round(method_duration/1000,3)
thanks guys that helped with the results
Maybe, try eval round function -
| eval method_duration=round(method_duration/1000,3)
you can use second instead miliseconds inserting an eval command like this before chart command
| eval method_duration=method_duration/1000
and obviously modifying span.
After this you can round your number to the decimals you prefer.
Bye.
Giuseppe