Under Visualization, I am getting the name and not value. Here is the query.
index="main" host="web_application" status="200" file="success.do" | stats sum(Price) as Revenue by ProductName | sort - Revenue
I used Automatic Lookup.
sort without a number; try this:
index="main" AND host="web_application" AND status="200" AND file="success.do" | stats sum(Price) AS Revenue BY ProductName | sort 0 - Revenue | rename Revenue AS Sales | eval Revenue="WebSales" | xyseries Revenue ProductName Sales
When you run the search, what do you see on the statistics tab? Does it look like a spreadsheet with the data you wish to see in a visualization or does it display incorrect data? What visualization are you trying to use on the results?
I think I figured it out. The reason it is coming as a string because I am using clause 'by ProductName'. So it is showing as top Product Name value from the column. If it is some numerical value I would have got some number. If I am wrong please feel free to correct me.
Thank you for trying to help me out.
let me understand:
is it correct?
If this is your need (as I said):
At this point (if you like) you can again enable your automatic lookup.
could you better describe what are the result you have and the result you want?
Are Price and ProductName in you data or do you take from the lookup? what's the lookup search?
To debug it, you could disable the automatic lookup and manually use it.
Ciao and Merry Christmas.
Merry Christmas. Thank you for taking time and helping others even on a holiday.
I am looking for the highest Revenue value to be displayed, not the ProductName. Price and ProductName are from Lookup.
as I said, the best approach is to disable the automatic lookup and manually use the lookup to understand if there's some problem on it:
I don't like automatic lookups because they bring problems in debugging and understanding search logic!
Anyway at first, check the field names between search results and lookup that must be the same (field names are case sensitive!).