topic How do I use a different aggregator based on a token? in Dashboards & Visualizations

How do I use a different aggregator based on a token?

sillingworth — Tue, 27 Jun 2017 15:53:40 GMT

I have this search:

... 
| rename value as "Response Time"
| timechart span=1m max("Response Time") by app_name limit=5 useother=false usenull=false

and I'd like to allow 'max("Response Time")' to change to 'avg("Response Time")' depending on user input. Is there a way to do this?

I've tried $token$("Response Time") but that doesn't work.

Re: How do I use a different aggregator based on a token?

sillingworth — Wed, 28 Jun 2017 10:03:23 GMT

Here's how I've done it:

        ...
        | stats max(value) as PerMinMax, avg(value) as PerMinAvg by _time, app_name
        | eval "Response Time"=case("Average"=="Max", PerMinMax, "Average"=="Average", PerMinAvg) 
        | timechart span=1m max("Response Time") by app_name limit=5 useother=false usenull=false