I am tring to run a chart report followting the exemple from Search manual p.71, I get a field named "Serveur"
index="" sourcetype="" |
stats count(CPU=0) as 0_CPU avg(CPU) as avg_CPU by _time Serveur |
eval s1="CPU_0 avgCPU" |
makemv s1 | mvexpand s1|
eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) |
eval series=Serveur+":"s1 | xyseries _time series yval
but there is an error with that eval in black, it shows "Error in 'eval' command: The expression is malformed. Expected )", but I just can't find where I missed the ")". Thanks for helping me.
