Hello,
How could I exclude rows where one out of two domains is showing a null value?
My search is:
| chart avg(time_taken) over uri by domainname
For example I get the following result
Uri | DomainA | DomainB
uri1 1.1 1.2
uri2 2.1
uri3 1.8 0.4
uri2 is having one null value. I would like to exclude the row for uri2.
Many thanks.
Try
... | eventstats dc(domainname) as doman_count | search domain_count>=2| chart avg(time_taken) over uri by domainname
Try
... | eventstats dc(domainname) as doman_count | search domain_count>=2| chart avg(time_taken) over uri by domainname
I've tried with eventstats, but I still see rows with null values.
if you simply want to drop rows with either column having a null. you could do something like
... | where isnotnull(DomainA) AND isnotnull(DomainB)
Both DomainA and DomainB are values (and not fields). Found the answer, it's possible with the following search:
index=in_oracle_soa sourcetype=oracle_soa_server_accesslog NOT "#" | rex "(?<c_ip>[^\t]+)\t(?<datum>[^\t]+)\t(?<tijd>[^\t]+)\t(?<method>[^\t]+)\t(?<uri>[^\t]+)\t(?<status_code>[^\t]+)\t(?<bytes>[^\t]+)\t(?<time_taken>[^\t]+)" |stats avg(time_taken) as "avg" by uri domainname |eventstats dc(domainname) as uniqvalues by uri | where uniqvalues>1 |xyseries uri,domainname,avg