multiple field conversions in a search eg kb to Mb

[Conradj]

Hi,

I have multiple fields returned in a search that I to plot as separate lines on a line graph. however, both fields are by default provided in bytes. I want to convert both in megabytes for the plot

Data might be for example...
time=12:00:00, memUsage=194433567, memPeak=1949456694

i can use | eval current=(memUsage/1024/1024)

But how do I convert the second? before going onto define the chart? (I am sure that its something very simple, but so far it has escaped me)

Cheers,

C.

[gkanapathy · Accepted solution]

Something like:

<search_term> | eval current=(memUsage/1024/1024) | eval peak=memPeak/1048576 | timechart span=1h avg(current), max(peak)

?

[Conradj]

(argh) Thank you 🙂

My error was in defining the chart to use two fields, not the conversion.