Field '_time' should have numerical values.

ayachem — Tue, 04 May 2010 04:46:19 GMT

Every time I try to run a report on a search, I get 0 records and the following error in the chart editor: Field '_time' should have numerical values.

My Query is: CallDetail>-1 sourcetype="3CX_cdr_custom" Dest<100 | rex field=Duration "(?<DUR>.*)..*" | convert dur2sec(DUR) as DurationSecs | stats sum(DurationSecs) as CallTime by Dest | search CallTime > 0

Basically, I configure the DUR = 00:00:XX, removing any numbers after the decimal place.

The stats in the results view look perfect, but then I try to run a report with sum(DurationSecs) split by Dest, It gives me the error. I can't pick CallTime from the report field list, so I used sum(DurationSecs) instead.

Any help would be greatly appreciated.

~ Michelle

Re: Field '_time' should have numerical values.

gkanapathy — Tue, 04 May 2010 06:30:20 GMT

try using chart instead of stats?

topic Re: Field '_time' should have numerical values. in Reporting

Field '_time' should have numerical values.

Re: Field '_time' should have numerical values.