I'm processing some IIS log files with a search:
stats count max(time_taken) avg(time_taken) as avgTT by cs_uri_stem | fieldformat avgTT=round(avgTT/1000,2) |rename avgTT as "Avg Response Time"
But the result displays a column for both "Avg Response Time" (which seems to lack the rounding I just did) and ALSO displays an (empty) column named avgTT.
How do I do a search and then simply change the text of the column title?
Try this
your base search | stats count max(time_taken) avg(time_taken) as avgTT by cs_uri_stem | eval avgTT=round(avgTT/1000,2) |rename avgTT as "Avg Response Time"
Try this
your base search | stats count max(time_taken) avg(time_taken) as avgTT by cs_uri_stem | eval avgTT=round(avgTT/1000,2) |rename avgTT as "Avg Response Time"
Thank you! This works. For some reason "eval" works when "fieldformat" doesn't. Doesn't make any logical sense to me but thank you very much for providing a working solution!