| multisearch
[ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=-2w@w1 latest=@w1
| eval event="1", when="then"
| eval event=event/2]
[ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=@w1 latest=@h+h
| eval event="1", when="now" ]
| eval Hour = strftime(_time,"%H")
| chart sum(event) AS events over date_wday by when
| eval sort_field = case(date_wday=="monday", 1,
date_wday=="tuesday", 2,
date_wday=="wednesday", 3,
date_wday=="thursday", 4,
date_wday=="friday", 5,
date_wday=="saturday", 6,
date_wday=="sunday", 7)
| sort 0 sort_field
| fields - sort_field
This seems to working fine, but I want the avg count to be always a integer. I tried round and other functions they didn't work.
@sandeepmakkena do you want the following?
| eval then=round(then,0)
Also, event eval does not seem necessary based on your query. Can you try the following?
| multisearch
[ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=-2w@w1 latest=@w1
| eval when="then"]
[ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=@w1 latest=@h+h
| eval when="now" ]
| chart count by date_wday when
| eval then=round(then/2,0)
| eval sort_field = case(date_wday=="monday", 1,
date_wday=="tuesday", 2,
date_wday=="wednesday", 3,
date_wday=="thursday", 4,
date_wday=="friday", 5,
date_wday=="saturday", 6,
date_wday=="sunday", 7)
| sort 0 sort_field
| fields - sort_field
Hi @sandeepmakkena ,
Round should work for providing an integer value as a result, but remember it's rounding, meaning if you have 3.51 it would round it to 4, and not set it to 3.
After your | chart ...
line you would put:
| eval events = round(events, 0)
If you want to drop the fraction instead of rounding you would use:
| eval events = mvindex(split(events, ".", 0)
@sandeepmakkena do you want the following?
| eval then=round(then,0)
Also, event eval does not seem necessary based on your query. Can you try the following?
| multisearch
[ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=-2w@w1 latest=@w1
| eval when="then"]
[ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=@w1 latest=@h+h
| eval when="now" ]
| chart count by date_wday when
| eval then=round(then/2,0)
| eval sort_field = case(date_wday=="monday", 1,
date_wday=="tuesday", 2,
date_wday=="wednesday", 3,
date_wday=="thursday", 4,
date_wday=="friday", 5,
date_wday=="saturday", 6,
date_wday=="sunday", 7)
| sort 0 sort_field
| fields - sort_field
This seems to be working, Thanks for your time.
@sandeepmakkena I have converted my comment to answer. If your issue is resolved please accept to mark this question as answered.
@sandeepmakkena if your issue is resolved, dont forget to mark the question as answered as this would help others facing similar issue as well.
Any specific reason to have | eval event=event/2
in your first query?