Hello there 😉
So, what I'm trying to do is the following.
I have inside the log all the slow queries.
I'm trying to create a chart to get from the timing of the slow queries, grouped by 10.
One bar counting the queries from 0 to 10 sec
the other from 10 to 20 and so on...
What I've done so far was that:
index="SUG" "slow query" | rex field=_raw "Slow Query (time: (?<OSY_timing>.*)s):" | eval OSY_new=round(tonumber(OSY_timing),-1) | stats count by OSY_new
Unfortunately, I'm not able to see any results inside OSY_new, where I should expect the values rounded by 10 (if I read the documentation correctly).
Any hint on how to do that?
Thanks.
P.s. I've the correct values inside OSY_timing
Resolved. The problem was in the name of the evaluated variable. Changed to something else solved the problem!
This works!
index="SUG" "slow query" | rex field=_raw "Slow Query (time: (?<OSY_timing>.*)s):" | eval VALORE = round(tonumber(trim(OSY_timing)),-1) | stats count by VALORE | sort VALORE
The name shouldn't have mattered, it looks more like the trim inside the tonumber was effective.
Tested and verified. The problem was the missing trim...
Yep, true, tried with the underscore value inside the name and it works... Dunno what happened here...