Summary row listing minimum value

adent — Thu, 19 Oct 2023 21:28:07 GMT

I am trying to get individual values and add a summary row with the minimum value. In this case I have 3 times and want the output to have all three times and create a minimum time row (labelname=min).

event _time

a 10:00

b 11:00
c 10:30

min 10:00

Re: Summary row listing minimum value

gcusello — Fri, 20 Oct 2023 06:59:51 GMT

Hi @adent,

Only one question, if you have events in more days, an event at previous day 23.59 is earlier than an event at second day 1.30, but calculatig min on the time value it's different.

Do you want to calculate min only on time or the earliest timestamp?

If min on time, you should run something like this:

if the earliest timestamp, you could try something like this:

<your_search> | stats earliest(_time) AS Time BY event | append [ search <your_search> | stats earlieste() AS _time | eval _time=strftime(_time,"%Y-%m-%d %H.%M")

I could be more detailed if you share a sample of your logs and (if you already have) a search that you're using?

Ciao.

Giuseppe

Re: Summary row listing minimum value

ITWhisperer — Fri, 20 Oct 2023 09:00:37 GMT

| appendpipe [| stats min(_time) as _time | eval event="min"]

topic Summary row listing minimum value in Dashboards & Visualizations

Summary row listing minimum value

Re: Summary row listing minimum value

Re: Summary row listing minimum value