Every time I try to run a report on a search, I get 0 records and the following error in the chart editor:
Field '_time' should have numerical values.
My Query is:
CallDetail>-1 sourcetype="3CX_cdr_custom" Dest<100 | rex field=Duration "(?<DUR>.*)..*" | convert dur2sec(DUR) as DurationSecs | stats sum(DurationSecs) as CallTime by Dest | search CallTime > 0
Basically, I configure the DUR = 00:00:XX, removing any numbers after the decimal place.
The stats in the results view look perfect, but then I try to run a report with sum(DurationSecs) split by Dest, It gives me the error. I can't pick CallTime from the report field list, so I used sum(DurationSecs) instead.
Any help would be greatly appreciated.
~ Michelle
