I've just encountered a strange thing that doesn't seem to be covered by an Answer or the docs.
If I have a chart command without a 'by' clause, the standard method of rounding works:
[search]| chart avg(thruput_hr) as Thruput over "Run Date" | eval Thruput=round(Thruput,2)
Results:
04/13 19.20
04/15 36.32
04/16 47.18
etc. as expected.
but if I add a by clause, it doesn't:
[search]| chart avg(thruput_hr) as Thruput over "Run Date" by year | eval Thruput=round(Thruput,2)
Results:
04/13 19.2
04/15 41.538461538 31.099
04/16 59.19 35.17241379
04/17 40.434782609 32.09
etc.
Is this WAD and I missed something, or is there a bug? Is there a way to do the rounding I want with chart?
If you check the statistics tab after adding by clause you will notice that there is no field called "Thruput". You can round off all fields this way.
[search]| chart avg(thruput_hr) over "Run Date" by year | foreach * [eval <<FIELD>>=round('<<FIELD>>',2)]
If you check the statistics tab after adding by clause you will notice that there is no field called "Thruput". You can round off all fields this way.
[search]| chart avg(thruput_hr) over "Run Date" by year | foreach * [eval <<FIELD>>=round('<<FIELD>>',2)]
Yeah thought it might be something like that because I did notice that 'Thruput' wasn't listed. Interesting though, that it can be rounded even though it's hiding. Well, that's show business.