Question

Usage of computed fields into process functions

  • 6 February 2024
  • 2 replies
  • 38 views

The following query put the result of processing function as “null” :
| chart max(log_ts) as maxlogts  | process format_date(maxlogts,'YYYY/MM/dd') as endDate | fields maxlogts, endDate 

 

I think the field “maxlogts” is not retrieved/recognized by function format_date().

There is a way to obtain the field “endDate” not null ?


2 replies

Userlevel 3
Badge +3

Hi Alexandru,

I have tested your search and i it seems like the |chart max(log_ts) as maxlogts breaks the process command.

Deleting it, it works fine.

I suggest you reach out to Logpoint support for further explanation on why “endDate” is null in this Query.

 

Best Regards,

Gustav

Hi Alexandru,

 

I have no idea why “endDate” ends up being null but I see what you are trying to achieve here, and you could use that instead: | chart max(log_ts) as maxlog_ts

If you suffix a field with “_ts” it’s going to be automatically formatted into a human-readable timestamp :)

 

Cheers,
Adrien

Reply