Rewriting value of field if value is negative

[mcwomble]

Hi,

I would like to rewrite bogus field values that are negative to 0. For example I would like to run the following search and plot a timechart of all 3 values, but change any that are negative to 0.

timechart max(mms_run_time_hour) as "MMS Run Time" max(vfn_run_time_hour) as "VFN Run Time" max(sms_run_time_hour)

Thanks

[Lowell · Accepted solution]

You can use an eval search command like this:

... | eval bogus_field=if(bogus_field>0, bogus_field, 0)

Or, perhaps even better:

... | eval bogus_field=max(bogus_field,0)