Hey people!
So I may be a big idiot and be missing something very simple but i cant seem to figure it out.
here is my search:
index=server1
|stats avg(score) as avgscore1
|append [index=server2
|stats avg(score) as avgscore2
|eval avgscore1=tonumber(avgscore1)
|eval avgscore2=tonumber(avgscore2)
|eval diff = avgscore1 - avgscore2
|eval change=if(diff > 0,"Down",if(diff < 0,"Up",if(diff == 0,"Same","Broken")))
No matter what I try i keep getting "Broken" even when i know the numbers are different. When i table diff, its blank. I've tried |eval diff = 5 - 7 and it works fine. Thinking that the avgscores weren't numbers, i used tonumber() so convert them but didnt work either. Any ideas?
Thank you in advanced!
... View more