i have an index with field (Value) that brings in results as bytes or percentage according to what the (counter) field is. example i need to round (value) field to two decimal places if (counter=available bytes) or round (Value) field if (counter=%free space).
Not sure if I understood correctly your question so if that's not the case please post an example.
In any case, try this and let me know if that's what you are looking for:
your search here
| eval Value = case (
counter == "available bytes", round(Value, 2),
counter == "%free space", round(Value),
1 == 1, "OTHERS"
)
The 1 == 1 is just a default clause to make sure you are not ignoring any potential values. You can then search Value = OTHERS to find out if something didn't match any of the previous two clauses.
Thanks,
J
Not sure if I understood correctly your question so if that's not the case please post an example.
In any case, try this and let me know if that's what you are looking for:
your search here
| eval Value = case (
counter == "available bytes", round(Value, 2),
counter == "%free space", round(Value),
1 == 1, "OTHERS"
)
The 1 == 1 is just a default clause to make sure you are not ignoring any potential values. You can then search Value = OTHERS to find out if something didn't match any of the previous two clauses.
Thanks,
J
this is what i needed. i made an edit but i guess it did not save. the available bytes i needed to convert bytes to Gb. i tried this sum(Value/1024/1024)
You need to convert your Value to GB before using sum.
Something like:
your search here
| eval Value = case (
counter == "available bytes", round(Value/1024/1024, 2),
counter == "%free space", round(Value),
1 == 1, "OTHERS"
)
By the way, if the response above is what you were looking for please do not forget to mark it as answered so that others can benefit from it.
Thanks
J
it does work. it didn't put the results where i needed them. i am trying to manipulate it to get everything the way i need it to work. thank you