I'm finding that timechart is returning null results if my number is less than 1.
earliest=-3d latest=-1d sourcetype=foo | timechart span=1h avg(value) as myValue by host
If the overall average of value is less than one ... ie: .2 or .7 etc ... I get a null result in myValue
This works fine for numbers 1 or greater.
I've tried using round
, exact
, and eval(avg(value)*10)
... I still get null results.
Try this:
earliest=-3d latest=-1d sourcetype=foo | timechart span=1h avg(tonumber(value)) as myValue by host
never mind ... If I change the provided value to 0.2, 0.7 etc ... this works.
Try this:
earliest=-3d latest=-1d sourcetype=foo | timechart span=1h avg(tonumber(value)) as myValue by host
Thank you ... that didn't quite work, but you pointed me in the right direction ...
earliest=-3d latest=-1d sourcetype=foo | eval number=tonumber(value) | timechart span=1h avg(number) as myValue by host