hi all,
i run this below query but it shows me error as
fiels"_time" Field '_time' should have numerical values.
source="C:\Users\20875\Desktop\taskmanager_log.txt" | transaction TaskBP startswith=START endswith=Succeeded | table TaskBP duration | join TaskBP [ | search source="C:\Users\20875\Desktop\task.txt"| transaction TaskBP startswith=START endswith=Succeeded|stats avg(duration) as Avgduration by TaskBP] | eval Diff=duration-Avgduration | table TaskBP Diff | where (Diff>-100 AND Diff<100) | timechart count(Diff) by TaskBP
kindly help me to get rid of this error
thanks in advance
poornima
Well, at a first guess without any testing you've removed the _time field by using the reporting command table to only pass those two fields.
Each time you pipe results over, reporting commands will only pass the fields you tell them to. Try adding _time to your commands and please please please read the tutorials