Hello,
I'm trying to use "timechart count by" a field from a subsearch. Bellow, my query that is not working.
index=index_cbo "Scope State: 65280" | eval CNPJPDV= CNPJ."-".PDV | append [search index=index_cbo_pt | eval CNPJPDV= CNPJ."-".PDV_PT| search index=index_cbo_pt [search index=index_cbo "Scope State: 65280" | eval CNPJPDV= CNPJ."-".PDV | table CNPJPDV] | table CNPJPDV PaymentChannelName]| timechart span=5m count by PaymentChannelName
It's resulting in a timechart will NULL column.
Thanks in advance.
Cheers,
rs
↧