I have the following search. What I would like is for the chart command to not get executed unless cix is equal to the number 1.
Is that possible? To have a conditional calculation?
| rename SMF70DTE as Date, SMF70TME as Time, SMF70SID as LPAR
| eval IntervalTime=strftime(_time,"%H.%M")
| rex "SMF70CIX_\d{4}\":\"(?P<cix>[0-9.]+)\""
| rex "SMF70PDT_\d{4}\":\"(?P<pdt>[0-9.]+)\""
| chart sum(pdt) over IntervalTime by LPAR
Thanks, Bob
After rex number 1 and before chart, insert this line
| search cix=1
It doesn't really matter if it's before or after rex number 2, but before rex number 2 is slightly more efficient.