I have multiple fields returned in a search that I to plot as separate lines on a line graph. however, both fields are by default provided in bytes. I want to convert both in megabytes for the plot
Data might be for example...
time=12:00:00, memUsage=194433567, memPeak=1949456694
i can use | eval current=(memUsage/1024/1024)
But how do I convert the second? before going onto define the chart? (I am sure that its something very simple, but so far it has escaped me)
<search_term> | eval current=(memUsage/1024/1024) | eval peak=memPeak/1048576 | timechart span=1h avg(current), max(peak)
View solution in original post
(argh) Thank you 🙂
My error was in defining the chart to use two fields, not the conversion.