Divide Time Chart Results by 2

[kmccowen]

index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType != "NULL" | timechart span=1d count by MessageType limit=0

I've tried to eval my counts of several different message types by 2 but it's not working. Any suggestions? I've worked around this issue by using a stats count instead of a timechart but I would like to figure this out within a timechart.

[kmccowen]

This is what I ended up doing but I want to time chart instead.

index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType = "PostCommunicationContact" OR MessageType="GetCommunicationContactsRequest" OR MessageType="charter.enterprise.deletecontactpoints.request" OR MessageType="charter.enterprise.SaveContactDataByValue.request" OR MessageType="charter.enterprise.findEventCommunicationByApplicationIdAndServiceEventId.request" OR MessageType="charter.enterprise.findUIEventFamilyByApplicationID.request" OR MessageType="charter.enterprise.findContactsByAccountNumberAndBillingSystem.request" OR MessageType="charter.enterprise.getcommpreference.request" OR MessageType="charter.enterprise.getcontactpoints.request" OR MessageType="charter.enterprise.savecommpreference.request" OR MessageType="charter.enterprise.deletecommpreference.request" | stats count by MessageType  | eval count=count/2 | eval count=round(count)

[woodcock · Accepted solution]

I have 2 answers.

This is how you can achieve the same thing:

index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType != "NULL" | timechart span=1d count by MessageType limit=0 | foreach * [eval <<FIELD>> = if((isnum($<<FIELD>>$)), $<<FIELD>>$/2, $<<FIELD>>$)]

This is how you can do exactly what you asked:

index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType != "NULL" | eval half=1/2 | timechart span=1d sum(half) by MessageType limit=0

[kmccowen]

This works great! What's the best way to get rid of the decimal places? Eval round?

[woodcock]

Yes, that's the way to do it.