Hi, I want to plot sum of two columns and plot it as timechart. Here is what I am doing,
source="2weeks.csv" | timechart eval(sum(FemaleGTotal) + sum(MaleGTotal))
This doesn't seems to work, where as both the following queries run fine.
source="2weeks.csv" | timechart sum(FemaleGTotal)
source="2weeks.csv" | timechart sum(MaleGTotal)
Use:
... | timechart sum(F) as sumf, sum(M) as summ | eval t=sumf+summ
Unless you're looking for:
... | timechart sum( eval(F + M) ) as t
Which differs in how null values are handled.
Use:
... | timechart sum(F) as sumf, sum(M) as summ | eval t=sumf+summ
Unless you're looking for:
... | timechart sum( eval(F + M) ) as t
Which differs in how null values are handled.
@gkanapathy: thanks, both queries are helpful to me. But what you mean, when you say that they differ in how null values are handled?