Timelion split and metric function together

Hello Kibana Experts,

I have below timelion function which works fine,

es(index=pt-rmlog-2019*, split=Hostname.keyword:5)


However, when i tried to add a metric like below it doesn't show anything up even no error message. I'm trying to see the total count of the User on a particular Host.

.es(index=pt-rmlog-2019*, split=Hostname.keyword:5, metric=sum:User)


.es(index=pt-rmlog-2019*, split=Hostname.keyword:5, metric=sum:User.keyword)

Below are my custom fields..


Would appreciate any help.


User seems to be a string-field, so you cannot do a sum on that. The sum-metric only works on numerical fields.

Thanks a Mile @thomasneirynck for the revert, Is there another Way we can count for the User

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.