Hi,
I try to use the function reset_after="("<'eval-expression'>")" of the command streamchart but it didn't work. I want to use this function when the field "description" contains "session is closed". I tried a lot of code, like this one:
|streamstats reset_after="("eval(description="session is closed")")" last(beam_number) as "beam"
but splunk always says "*Error in 'streamstats' command: The expression is malformed. Expected ).*" I don't know how I have to write that?
Thanks for the help
↧