How to visualize count of messages between .. and .. MB, .. and .. MB etc.?

[svester]

Hi,
i want to see how many messages are send, which are between 0 and 1 mb, between 1MB and 2MB, 2 and 3 etc, but I can't even visualize 1 option 😞

I have this: index, host source etc.
| eval if((LENGTH >= 0 AND LENGTH <= 10000000), "Between 0MB en 1MB", "Rest")
| stats count(LENGTH)

Note: LENGTH= shown like this: [LENGTH=365] and is an interesting field (num), shown in bytes.

So i have 2 questions:
- I receive this error with above eval: *Error in 'eval' command: Type checking failed. 'AND' only takes boolean arguments. *
What is wrong with this argument?
- And can someone help me fixing this visualization?

[nickhills · Accepted solution]

The first issue is that your eval syntax is not quite right. Use:

|eval size=if((LENGTH >= 0 AND LENGTH <= 10000000), "Between 0MB en 1MB", "Rest")
| stats count(size)

although case may be a better choice in this scenario.

|eval size=case((LENGTH >= 0 AND LENGTH <= 10000000), "0MB - 1MB", (LENGTH >= 10000001 AND LENGTH <= 20000000), "1MB - 2MB",(LENGTH >= 20000001 AND LENGTH <= 30000000), "2MB - 3MB",1=1, "Bigger")
| stats count(size)

[svester]

Thanks, I added "by size" to make the visualization better.

 | stats count(size) by size

[nickhills]

Great, Glad to have helped.