Panel using Round and Sort

[hsh]

Hi

I have a dashboard that displays the numerial value of a field called method_duration.

The value is in ms.

The search string I have looks like this:

index=bec_ci_prod ("deploy_status_type=info" "direction=exiting") | sort + method_duration | chart count by method_duration span=10000

The result from thus is actually as expected. But now I would like to show the method_duration in seconds and not in miliseconds

I then add this to the search string:
| fieldformat method_duration=round(method_duration/1000)

The result is that when listing the result several of the results now have the same value like 5-6 results showing 0 etc.

How could you get Spluk to show all the rounded numbers that end up being 0 in just one result ?

Also when i try to add the span=10 all the results values are blank but the count remains. I think it has something to do with the first problem where multiple results now sjhow the same value

Any idea how to solve this ?

[hsh]

thanks guys that helped with the results

[inventsekar · Accepted solution]

Maybe, try eval round function -

| eval method_duration=round(method_duration/1000,3)

[gcusello]

you can use second instead miliseconds inserting an eval command like this before chart command
| eval method_duration=method_duration/1000
and obviously modifying span.
After this you can round your number to the decimals you prefer.
Bye.
Giuseppe