Hey there,
I'm trying to do two things and it looks like I can't. I have some fields with ugly names like "Current_SuccessPercent" that I want to rename. I also want to format the data in the field to be human readable. So I have the following search:
index=summary_foo
| stats sum(response_time) as response_time, sum(http_200) as http_200, sum(http_400) as http_400 by sourcetype
| eval Current_SuccessPercent = (http_200 / (http_200 + http_400)) * 100
| fieldformat "Response Time" = tostring(round(response_time,2),"commas")." ms"
| fieldformat "Success Ratio" = tostring(round(Current_SuccessPercent,0))."%"
| rename sourcetype as Sourcetype
In my results table this gives me two columns, Current_SuccessPercent and Success Ratio. The output is formatted correctly on Success Ratio but the sorting does not work correctly. And the formatting is incorrect on Current_SuccessPercent but I can sort by the values. If I use
| fieldformat Current_SuccessPercent = tostring(round(Current_SuccessPercent,0))."%"
The formatting is correct and I can sort appropriately. But then the column name looks bad and if I try to rename it I break formatting (I see two columns, one with my unformatted data, and one that is empty with the correct column name). Or if I try to rename before the fieldformat I cannot reference a column name with spaces in it inside the round method.
So can I not rename a column AND use fieldformatting AND be able to sort by that column?
... View more