Hi,
I would like to rewrite bogus field values that are negative to 0. For example I would like to run the following search and plot a timechart of all 3 values, but change any that are negative to 0.
timechart max(mms_run_time_hour) as "MMS Run Time" max(vfn_run_time_hour) as "VFN Run Time" max(sms_run_time_hour)
Thanks
You can use an eval search command like this:
... | eval bogus_field=if(bogus_field>0, bogus_field, 0)
Or, perhaps even better:
... | eval bogus_field=max(bogus_field,0)
You can use an eval search command like this:
... | eval bogus_field=if(bogus_field>0, bogus_field, 0)
Or, perhaps even better:
... | eval bogus_field=max(bogus_field,0)