We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Describe the bug
index=abc earliest =-4y | timechart count by source avg(host) by sourcetype works, even though only one BY clause should be possible.
index=abc earliest =-4y | timechart count by source avg(host) by sourcetype
Expected behavior
A list of aggregates can be given, but there should only be one by clause for all of them.
Example: index=abc earliest =-4y | timechart count avg(host) by sourcetype where both count and avg(host) will be grouped by the sourcetype column.
index=abc earliest =-4y | timechart count avg(host) by sourcetype
count
avg(host)
sourcetype
How to reproduce
Run the query above.
Screenshots
Software version
5.4.0
Desktop (please complete the following information if relevant):
Additional context
The text was updated successfully, but these errors were encountered:
Internal PR created.
However, not going to merge until the relevant changes are ready in PTH-10.
Sorry, something went wrong.
51-code
No branches or pull requests
Describe the bug
index=abc earliest =-4y | timechart count by source avg(host) by sourcetype
works, even though only one BY clause should be possible.
Expected behavior
A list of aggregates can be given, but there should only be one by clause for all of them.
Example:
index=abc earliest =-4y | timechart count avg(host) by sourcetype
where both
count
andavg(host)
will be grouped by thesourcetype
column.How to reproduce
Run the query above.
Screenshots
Software version
5.4.0
Desktop (please complete the following information if relevant):
Additional context
The text was updated successfully, but these errors were encountered: