Timelion split and metric function together

Elastic Stack Kibana
1

Hello Kibana Experts,

I have below timelion function which works fine,

es(index=pt-rmlog-2019*, split=Hostname.keyword:5)

image

However, when i tried to add a metric like below it doesn't show anything up even no error message. I'm trying to see the total count of the User on a particular Host.

.es(index=pt-rmlog-2019*, split=Hostname.keyword:5, metric=sum:User)

OR

.es(index=pt-rmlog-2019*, split=Hostname.keyword:5, metric=sum:User.keyword)

Below are my custom fields..

image

Would appreciate any help.

2

@Rocky_RK

User seems to be a string-field, so you cannot do a sum on that. The sum-metric only works on numerical fields.

3

Thanks a Mile @thomasneirynck for the revert, Is there another Way we can count for the User