The following query put the result of processing function as “null” :
| chart max(log_ts) as maxlogts | process format_date(maxlogts,'YYYY/MM/dd') as endDate | fields maxlogts, endDate
I think the field “maxlogts” is not retrieved/recognized by function format_date().
There is a way to obtain the field “endDate” not null ?
Share This Post:
Hi Alexandru,
I have tested your search and i it seems like the |chart max(log_ts) as maxlogts breaks the process command.
Deleting it, it works fine.
I suggest you reach out to Logpoint support for further explanation on why “endDate” is null in this Query.
Best Regards,
Gustav
Hi Alexandru,
I have no idea why “endDate” ends up being null but I see what you are trying to achieve here, and you could use that instead:
| chart max(log_ts) as maxlog_ts
If you suffix a field with “_ts” it’s going to be automatically formatted into a human-readable timestamp :)
Cheers,
Adrien
Hello,
thank you for answers.
@Adrien Debosschere
: indeed, suffixing a field with “_ts” will automatically format in human readable format (but the specific format “YYYY/MM/DD hh:mm:ss”, if you want other format … will come back to presented issue). This suffix “_ts” is a valuable information which I didn’t found into documentation.
Please sign in to leave a comment.
3 comments