You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Aug 2, 2022. It is now read-only.
I can use "search source=210324|fields event_duration, inbuilt_meta.log_timestamp|eval day_str=date_format(inbuilt_meta.log_timestamp, 'yyyy-MM-dd HH')" to get the right answer, but the method do not aggregate all of data, it just aggregate the head part of data
I input PPL "search source=210324|stats max(event_duration) by date_format(inbuilt_meta.log_timestamp, 'yyyy-MM-dd HH')".
Got the error
{ "error": { "reason": "Invalid Query", "details": "Failed to parse query due to offending symbol [date_format] at: 'search source=*210324*|stats max(event_duration) by date_format' <--- HERE... More details: Expecting tokens in {'D', '.', '
', 'AVG', 'COUNT', 'MAX', 'MIN', 'SUM', 'FIRST', 'LAST', 'DATE', 'TIME', 'TIMESTAMP', ID, BQUOTA_STRING}","type": "SyntaxCheckException"
},
"status": 400
}`
It looks like stats by do not support very much function
The text was updated successfully, but these errors were encountered: