Hi, I am trying to get a visualization to show the average sentiment of a search term by the index.
index=* foo | table text| vader textfield=text| stats avg(sentiment) as sentiment
as expected gives me a decimal return labelled sentiment
index=* foo | table text| vader textfield=text| stats avg(sentiment)
returns the same decimal unlabeled
but I can not get
index=* foo | table text| vader textfield=text| stats avg(sentiment) by index
to return a sentiment decimal based on the results from the different indexes, I am obviously going wrong somewhere but I can not work out where, any help is greatly appreciated.
@denymw,
In your search, you are using | table text
which restricts the fields to only text
. If you need index also part of your stats
, add index also to the table command or remove the table command completely.
Try
index=* foo | vader textfield=text| stats avg(sentiment) as sentiment by index
@denymw,
In your search, you are using | table text
which restricts the fields to only text
. If you need index also part of your stats
, add index also to the table command or remove the table command completely.
Try
index=* foo | vader textfield=text| stats avg(sentiment) as sentiment by index
thank you so much, I didn't even see I had copied that in.