topic Re: Create a chart from a converted number in Dashboards & Visualizations

RESOLVED - Create a chart from a converted number

marco_carolo — Tue, 27 Apr 2021 14:41:50 GMT

Hello there 😉

So, what I'm trying to do is the following.

I have inside the log all the slow queries.

I'm trying to create a chart to get from the timing of the slow queries, grouped by 10.

One bar counting the queries from 0 to 10 sec

the other from 10 to 20 and so on...

What I've done so far was that:

index="SUG" "slow query" | rex field=_raw "Slow Query (time: (?<OSY_timing>.*)s):" | eval OSY_new=round(tonumber(OSY_timing),-1) | stats count by OSY_new

Unfortunately, I'm not able to see any results inside OSY_new, where I should expect the values rounded by 10 (if I read the documentation correctly).

Any hint on how to do that?

Thanks.

P.s. I've the correct values inside OSY_timing

Re: Create a chart from a converted number

marco_carolo — Tue, 27 Apr 2021 13:30:52 GMT

Resolved. The problem was in the name of the evaluated variable. Changed to something else solved the problem!

This works!

index="SUG" "slow query" | rex field=_raw "Slow Query (time: (?<OSY_timing>.*)s):" | eval VALORE = round(tonumber(trim(OSY_timing)),-1) | stats count by VALORE | sort VALORE

Re: Create a chart from a converted number

ITWhisperer — Tue, 27 Apr 2021 14:48:45 GMT

The name shouldn't have mattered, it looks more like the trim inside the tonumber was effective.

Re: Create a chart from a converted number

marco_carolo — Tue, 27 Apr 2021 14:55:38 GMT

Yep, true, tried with the underscore value inside the name and it works... Dunno what happened here...

Re: Create a chart from a converted number

marco_carolo — Tue, 27 Apr 2021 15:02:12 GMT

Tested and verified. The problem was the missing trim...