Hi When I run the command below, it works fine index=toto event_id=4688 |
eval file_name=if(event_id==4688, replace(NewProcessName, "^*\\\\([^\\\\]+)$","\\1"),null) Now I need t...
Hi all,
During evaluating round I got the error:
| stats avg(duration) AS "booking average time" by hours
| eval "booking average time"=round("booking average time",2)
Error in 'eval' c...
I'm trying to evaluate the date string to a time format sing the strptime() the format I have is: Tue_Oct_25_03:57:49_IDT_2022
the strptime function looks like: strptime(d...
...rrayName$ by sgname Array_Name Model
|eval SOT=case(Model="ModelA", 94000, Model="ModelB", 104000), PctIOPS=round((sgIOPS/SOT)*100, 2)
| sort - PctIOPS
| head 5
| table Array_Name Model SOT s...
Hi
As you can see, I use a first eval in order to rename the field "site"
From the site renamed, I need to create a new field called "toto" in order to add new information for the field site.
S...
...t;.+?)$"
| search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf
| eval Actual=case(filename="S...
Hi, I wonder whether someone can help me please.
I'm using number the following as part of a query to extract data from a summary Index
| stats count(eval(repayments_submit="1")) as r...