max abs not returning results

[sarit_s]

Hello,

why this query does not return any results while there are events ?

sourcetype=timekeeper_status host=* | eval offsets=(offsets."0")  | timechart span=30s max(abs(offsets."0")) by host

[ITWhisperer]

The max aggregator needs a field to work with, not a calculated value

sourcetype=timekeeper_status host=* | eval offsets=(offsets."0") 
| eval absoffsets=abs(offsets."0")
| timechart span=30s max(absoffsets) by host

[sarit_s]

already tried it but im getting this error :

Error in 'eval' command: The arguments to the 'abs' function are invalid.

[ITWhisperer]

sourcetype=timekeeper_status host=* | eval offsets=(offsets."0") 
| eval absoffsets=offsets."0"
| eval absoffsets=abs(absoffsets)
| timechart span=30s max(absoffsets) by host

[sarit_s]

no results ...