About dunick_

dunick_ · ‎10-12-2022

Hello @PickleRick, thank you for your answer and support. I believe that the issue was really related to my extraction. I extracted the same field with same regex again but gave the field another name (mount_usage_kb_extracted). Then it worked as expected... sourcetype=app:my_app AND mount_usage_kb | eval mount_usage_mb=(mount_usage_kb_extracted/1024) | timechart max(mount_usage_mb) as "Used storage MB"

dunick_ · ‎10-12-2022

Hello community, I am new here and I have a simple question on my chart which is not working as expected. Currently I have the following chart which brings me the dusk usage in KBytes. It works perfectly: sourcetype=app:my_app AND mount_usage_kb | timechart max(mount_usage_kb) as "Mount size in KB" I tried to eval a new variable to have the values in MBytes, but it does not work, the chart is empty and values not shown (even on the table): sourcetype=app:my_app AND mount_usage_kb | eval mount_usage_mb=(mount_usage_kb/1024) | timechart max(mount_usage_mb) as "Used storage MB" Any clue on what I am doing wrong? Thanks a lot

Posts	2
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎10-12-2022

Online Status	Offline
Date Last Visited	‎10-12-2022 11:53 AM

Eval for new variable not working as expected?

Re: Eval for new variable not working as expected

Eval for new variable not working as expected?