Hi,
i want to see how many messages are send, which are between 0 and 1 mb, between 1MB and 2MB, 2 and 3 etc, but I can't even visualize 1 option 😞
I have this: index, host source etc.
| eval if((LENGTH >= 0 AND LENGTH <= 10000000), "Between 0MB en 1MB", "Rest")
| stats count(LENGTH)
Note: LENGTH= shown like this: [LENGTH=365] and is an interesting field (num), shown in bytes.
So i have 2 questions:
- I receive this error with above eval: *Error in 'eval' command: Type checking failed. 'AND' only takes boolean arguments. *
What is wrong with this argument?
- And can someone help me fixing this visualization?
The first issue is that your eval syntax is not quite right. Use:
|eval size=if((LENGTH >= 0 AND LENGTH <= 10000000), "Between 0MB en 1MB", "Rest")
| stats count(size)
although case
may be a better choice in this scenario.
|eval size=case((LENGTH >= 0 AND LENGTH <= 10000000), "0MB - 1MB", (LENGTH >= 10000001 AND LENGTH <= 20000000), "1MB - 2MB",(LENGTH >= 20000001 AND LENGTH <= 30000000), "2MB - 3MB",1=1, "Bigger")
| stats count(size)
The first issue is that your eval syntax is not quite right. Use:
|eval size=if((LENGTH >= 0 AND LENGTH <= 10000000), "Between 0MB en 1MB", "Rest")
| stats count(size)
although case
may be a better choice in this scenario.
|eval size=case((LENGTH >= 0 AND LENGTH <= 10000000), "0MB - 1MB", (LENGTH >= 10000001 AND LENGTH <= 20000000), "1MB - 2MB",(LENGTH >= 20000001 AND LENGTH <= 30000000), "2MB - 3MB",1=1, "Bigger")
| stats count(size)
Thanks, I added "by size" to make the visualization better.
| stats count(size) by size
Great, Glad to have helped.