I was getting when I run the below query, can someone give me the solution pls,
below is my query:
| convert num(actualTimeExtract) as actualTime
|eval buckt=case (
actualTime<1001, “time < 1 sec”,
actualTime>1000 AND actualTime<5001, “1 < time < 5”,
1=1, “time > 15”)
|stats dc(hdr.macaddress) by buckt
Hi sarathipattam,
this is most likely a copy/paste problem, you have “
instead of "
. Try the run everywhere search below to see how it works:
| makeresults
| eval actualTime="1000"
| eval buckt=case (
actualTime<1001, "time < 1 sec",
actualTime>1000 AND actualTime<5001, "1 < time < 5",
1=1, "time > 15")
Hope this helps ...
cheers, MuS
@MuS, it was only yesterday that @xpac and I spoke of the devil “
😄