index=xxx source=daltrace.log |rex field=_raw " TRACE # (?.)#(?.)#(?.)#(?.)#(?.)#(?.)#(?.)#(?.)#(?.)#(?.)#(?.)"|eval Response_Time=(RESPONSETIME/1000) |timechart eval(round(avg(Response_Time),2) as AvgResponseTime by OPERATIONNAME |fillnull value=0.00
The normal text field when you post a question will not render <
or >
. Your regular expression is not rendering. To enter code correctly, enter a newline and indent 4 spaces.
Like this
The most likely issue is that the field RESPONSETIME does not exist in the data or might not be a numeric field. Does this search return results?
index=xxx source=daltrace.log RESPONSETIME=*
If RESPONSETIME does exist, it might not be a numeric field. Does this search return results?
index=xxx source=daltrace.log | stats sum(RESPONSETIME)
Alternatively, are you getting any error when you run the search relating to eval?