In the following search:
index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | stats sum(GB) as total by series | addinfo | eval days = (info_max_time - info_min_time) / 86400 | fields - info* | eval daily_average = total / days
What does the "fields - info*" do?
Thanks.
Hi,
It will remove all fields starting with info
from results. When you use | addinfo
command it will add info_max_time
, info_min_time
, info_search_time
and info_sid
fields. So when you add | fields - info*
it will remove all these fields from results.
Your query before the | addinfo
command calculates the amount of data sent by each host in GB. The | addinfo
adds many info*
fields in the search which includes the time range (the info_min_time i.e. earliest and info_max_time i.e. latest). You're using those time range epoch valued fields to get number of days in your time range. Once the number of days are calculate, you're removing those info*
fields as you don't want to show them, by using | fields - info*
.
Thanks...!
Hi,
It will remove all fields starting with info
from results. When you use | addinfo
command it will add info_max_time
, info_min_time
, info_search_time
and info_sid
fields. So when you add | fields - info*
it will remove all these fields from results.
Thanks. That makes sense. 🙂