Usage of computed fields into process functions

  • 6 February 2024
  • 3 replies

The following query put the result of processing function as “null” :
| chart max(log_ts) as maxlogts  | process format_date(maxlogts,'YYYY/MM/dd') as endDate | fields maxlogts, endDate 


I think the field “maxlogts” is not retrieved/recognized by function format_date().

There is a way to obtain the field “endDate” not null ?

3 replies

Userlevel 3
Badge +3

Hi Alexandru,

I have tested your search and i it seems like the |chart max(log_ts) as maxlogts breaks the process command.

Deleting it, it works fine.

I suggest you reach out to Logpoint support for further explanation on why “endDate” is null in this Query.


Best Regards,


Hi Alexandru,


I have no idea why “endDate” ends up being null but I see what you are trying to achieve here, and you could use that instead: | chart max(log_ts) as maxlog_ts

If you suffix a field with “_ts” it’s going to be automatically formatted into a human-readable timestamp :)




thank you for answers.
@Adrien Debosschere : indeed, suffixing a field with “_ts” will automatically format in human readable format (but the specific format “YYYY/MM/DD hh:mm:ss”, if you want other format … will come back to presented issue). This suffix “_ts” is a valuable information which I didn’t found into documentation.