Doing a search that has a wide range of return values... and the largest one will not display on my chart! I have 7 evals with values, but the chart only display 6 of them! I'm going crazy.
SEARCH:
index=tomcat time_taken_ms=* sourcetype=access_common
|eval Sub1s=if(time_taken_ms>=200 AND time_taken_ms<1000,1,0)
|eval Sub2s=if(time_taken_ms>=1000 AND time_taken_ms<2000,1,0)
|eval Sub3s=if(time_taken_ms>=2000 AND time_taken_ms<3000,1,0)
|eval Sub4s=if(time_taken_ms>=3000 AND time_taken_ms<4000,1,0)
|eval Sub5s=if(time_taken_ms>=4000 AND time_taken_ms<5000,1,0)
|eval Over5s=if(time_taken_ms>=5000 AND time_taken_ms<10000,1,0)
|eval Over10s=if(time_taken_ms>=10000,1,0)
|chart sum(Sub1s) sum(Sub2s) sum(Sub3s) sum(Sub4s) sum(Sub5s) sum(Over5s) sum(Over10s)
PICTURE OUT OUTPUT:
... View more