RESOLVED - Create a chart from a converted number

[marco_carolo]

Hello there 😉

So, what I'm trying to do is the following.

I have inside the log all the slow queries.

I'm trying to create a chart to get from the timing of the slow queries, grouped by 10.

One bar counting the queries from 0 to 10 sec

the other from 10 to 20 and so on...

What I've done so far was that:

index="SUG" "slow query" | rex field=_raw "Slow Query (time: (?<OSY_timing>.*)s):" | eval OSY_new=round(tonumber(OSY_timing),-1) | stats count by OSY_new

Unfortunately, I'm not able to see any results inside OSY_new, where I should expect the values rounded by 10 (if I read the documentation correctly).

Any hint on how to do that?

Thanks.

P.s. I've the correct values inside OSY_timing

[marco_carolo]

Resolved. The problem was in the name of the evaluated variable. Changed to something else solved the problem!

This works!

index="SUG" "slow query" | rex field=_raw "Slow Query (time: (?<OSY_timing>.*)s):" | eval VALORE = round(tonumber(trim(OSY_timing)),-1) | stats count by VALORE | sort VALORE

[ITWhisperer]

The name shouldn't have mattered, it looks more like the trim inside the tonumber was effective.

[marco_carolo · Accepted solution]

Tested and verified. The problem was the missing trim...

[marco_carolo]

Yep, true, tried with the underscore value inside the name and it works... Dunno what happened here...