Field '_time' should have numerical values.

[ayachem]

Every time I try to run a report on a search, I get 0 records and the following error in the chart editor: Field '_time' should have numerical values.

My Query is: CallDetail>-1 sourcetype="3CX_cdr_custom" Dest<100 | rex field=Duration "(?<DUR>.*)..*" | convert dur2sec(DUR) as DurationSecs | stats sum(DurationSecs) as CallTime by Dest | search CallTime > 0

Basically, I configure the DUR = 00:00:XX, removing any numbers after the decimal place.

The stats in the results view look perfect, but then I try to run a report with sum(DurationSecs) split by Dest, It gives me the error. I can't pick CallTime from the report field list, so I used sum(DurationSecs) instead.

Any help would be greatly appreciated.

~ Michelle

[gkanapathy]

try using chart instead of stats?