Hi! I'm trying to figure out what I'm doing wrong with this stats query:
"Advanced checkpoint" | rex "shardId-0+(?<shardId>\d+) to (?<checkpoint>\d+)" | convert num(shardId) num(checkpoint) | stats min(checkpoint) max(checkpoint) count(checkpoint) by shardId
I get the following results:
shardId min(checkpoint) max(checkpoint) count(checkpoint)
0 49560932439872968484629418486593580327004169175954358272 49560932439872968484629418486593580327004169175954358272 13
1 49560932452026874617828608098730546785597526196713684992 49560932452026874617828608098730546785597526196713684992 13
2 49560932427429152663849330773616649530866383455617286144 49560932427429152663849330773616649530866383455617286144 13
6 49568412890294036113805838273969294693600630993783357440 49568412890294036113805838273969294693600630993783357440 61
7 49568412890316336859004368897110830411873279355289337856 49568412890316336859004368897110830411873279355289337856 60
8 49568412901399807222674088598454082393379515023761604608 49568412901399807222674088598454082393379515023761604608 60
9 49568412901422107967872619221595618111652163385267585024 49568412901422107967872619221595618111652163385267585024 60
The problem is that for some reason I'm not getting the actual min and the max values for each shard— I'm getting the same value for both min and max .
It is not the case that all of the checkpoint values are the same for a given shardId . For instance, the two most recent events for shardId=0 are as follows:
_time shardId checkpoint
3/16/17 9:12:45.085 PM 0 49560932439872968484643752785443264706111991494612090882
3/16/17 8:54:44.860 PM 0 49560932439872968484643752274065225157484546774917971970
Thoughts? Any help is greatly appreciated 🙂
... View more