topic Panel using Round and Sort in Dashboards & Visualizations

Panel using Round and Sort

hsh — Tue, 29 Sep 2020 11:06:08 GMT

I have a dashboard that displays the numerial value of a field called method_duration.

The value is in ms.

The search string I have looks like this:

index=bec_ci_prod ("deploy_status_type=info" "direction=exiting") | sort + method_duration | chart count by method_duration span=10000

The result from thus is actually as expected. But now I would like to show the method_duration in seconds and not in miliseconds

I then add this to the search string:
| fieldformat method_duration=round(method_duration/1000)

The result is that when listing the result several of the results now have the same value like 5-6 results showing 0 etc.

How could you get Spluk to show all the rounded numbers that end up being 0 in just one result ?

Also when i try to add the span=10 all the results values are blank but the count remains. I think it has something to do with the first problem where multiple results now sjhow the same value

Any idea how to solve this ?

Re: Panel using Round and Sort

gcusello — Wed, 30 Sep 2020 02:53:57 GMT

you can use second instead miliseconds inserting an eval command like this before chart command
| eval method_duration=method_duration/1000
and obviously modifying span.
After this you can round your number to the decimals you prefer.
Bye.
Giuseppe

Re: Panel using Round and Sort

inventsekar — Mon, 26 Sep 2016 07:21:22 GMT

Maybe, try eval round function -

| eval method_duration=round(method_duration/1000,3)

Re: Panel using Round and Sort

hsh — Mon, 26 Sep 2016 07:33:44 GMT

thanks guys that helped with the results