Filter a Chart with Values Greater Than some Integer.

[3666142]

I have this query (time is in milliseconds and I converted it to seconds):

index=ABCD source=EFGH
| bin span=5m _time
| eval timeDiff=(endTime-startTime)/1000
| timechart span=5m eval(round(avg(timeDiff),3))

It gives me this data:

_time=13:45:00 timeDiff=0.479
_time=13:45:05 timeDiff=1.716
_time=13:45:10 timeDiff=1.276
_time=13:45:15 timeDiff=0.627
_time=13:45:20 timeDiff=1.771
_time=13:45:25 timeDiff=0.855
_time=13:45:30 timeDiff=1.670

I am trying to create a chart that displays all the timeDiff that are > 1. (I am ok with the blank values.)
Example:
_time=13:45:00

_time=13:45:05 timeDiff=1.716
_time=13:45:10 timeDiff=1.276
_time=13:45:15

_time=13:45:20 timeDiff=1.771
_time=13:45:25

_time=13:45:30 timeDiff=1.670

I was thinking about doing something with the where argument, but I'm not sure.
If someone could help me out that would be awesome! Thank you.

[memarshall63 · Accepted solution]

To get from here:

     _time=13:45:00 timeDiff=0.479
     _time=13:45:05 timeDiff=1.716
     _time=13:45:10 timeDiff=1.276
     _time=13:45:15 timeDiff=0.627
     _time=13:45:20 timeDiff=1.771
     _time=13:45:25 timeDiff=0.855
     _time=13:45:30 timeDiff=1.670

To here:

_time=13:45:00 
_time=13:45:05 timeDiff=1.716
_time=13:45:10 timeDiff=1.276
_time=13:45:15 
_time=13:45:20 timeDiff=1.771
_time=13:45:25 
_time=13:45:30 timeDiff=1.670

You can just add to the end:

   | eval timeDiff=if(timeDiff>1,timeDiff,null)

[3666142]

That is exactly what I needed. Thank you!

[Sukisen1981]

is this some sort of a pseudo code? firstly what is the link between timeDiff and cleanse time. you also can not use eval in a tiemchart like that, you have to rename it like this - | timechart span=5m eval(round(avg(cleanseTime),3)) as x

what are you trying to do exactly?

[3666142]

Sorry cleanseTime is actually timeDiff. Let me fix it.

[mayurr98]

<your search > | where timeDiff>1 works for you?

[3666142]

I have tried that and I get no results.