@kristian_kolb  LOL this comment made my day 8 years later -Marco ... View more

This works with some workaround on data model , here is new query | tstats sum(ABC.time) as time FROM datamodel=DataModel_ABC groupby ABC.id,_time|| timechart avg(time) as time by id however, I was using post processing in my dashboard. so now I have to write one direct query in dashboard. second avg time value I am not able to round up, as after this search round function is not working, may be I am missing something eval time=round(time,2) third, I am plotting TPS, but using this model and printing below query doesn't give right information on data model. | eval count=1 | timechart per_second(count) ... View more

Please mark as accepted if this answers your question completely. Thanks! ... View more

thanks! "rex" can solve it. but, now I need to search consecutive and same logs. that is, In addition to meet "3 same contents(except timestamps in front) in 2 seconds", the events must sequent in position, for example: the original log: " Oct 31 2014 14:34:08 repeated 114 times. Oct 31 2014 14:34:11 xiaowang CID=0x80600406; repeated 4 times. Oct 31 2014 14:34:11 xiaowang CID=0x80600406; repeated 4 times. Oct 31 2014 14:34:11 repeated 114 times. Oct 31 2014 14:34:11 xiaowang CID=0x80600406; repeated 4 times. Oct 31 2014 14:34:15 xiaowang CID=0x80600406; repeated 4 times. Oct 31 2014 14:34:22 xiaowang CID=0x80600406; repeated 4 times. Oct 31 2014 14:34:24 xiaowang CID=0x80600406; repeated 4 times. " the hindermost 4 events meet the criteria, and we get the result: " Oct 31 2014 14:34:11 xiaowang CID=0x80600406; repeated 4 times. Oct 31 2014 14:34:15 xiaowang CID=0x80600406; repeated 4 times. Oct 31 2014 14:34:22 xiaowang CID=0x80600406; repeated 4 times. Oct 31 2014 14:34:24 xiaowang CID=0x80600406; repeated 4 times. " how to realize it ? thanks for any advice! this problem is urgent, please give me some help. I want to create a new posting, but it I have not enough reputation. ... View more