Help Center Logpoint Docs Idea Portal Logpoint.com
Question

Usage of computed fields into process functions

  • 6 February 2024
  • 3 replies
  • 64 views
A

The following query put the result of processing function as “null” :
| chart max(log_ts) as maxlogts  | process format_date(maxlogts,'YYYY/MM/dd') as endDate | fields maxlogts, endDate 

 

I think the field “maxlogts” is not retrieved/recognized by function format_date().

There is a way to obtain the field “endDate” not null ?

3 replies

G
Rank
Userlevel 3
Badge +3

Hi Alexandru,

I have tested your search and i it seems like the |chart max(log_ts) as maxlogts breaks the process command.

Deleting it, it works fine.

I suggest you reach out to Logpoint support for further explanation on why “endDate” is null in this Query.

 

Best Regards,

Gustav

Adrien Debosschere
Rank

Hi Alexandru,

 

I have no idea why “endDate” ends up being null but I see what you are trying to achieve here, and you could use that instead: | chart max(log_ts) as maxlog_ts

If you suffix a field with “_ts” it’s going to be automatically formatted into a human-readable timestamp :)

 

Cheers,
Adrien

Sales Engineer - South EMEA
A

Hello,

thank you for answers.
@Adrien Debosschere : indeed, suffixing a field with “_ts” will automatically format in human readable format (but the specific format “YYYY/MM/DD hh:mm:ss”, if you want other format … will come back to presented issue). This suffix “_ts” is a valuable information which I didn’t found into documentation. 

 

Reply


Terms & ConditionsCookie settings