Mark the Unit for a Field at Query Time
Use the unit( )
function of the eval
command to mark the unit of a field in the Link user interface.
For a complete list of the supported units, see Supported Types for the unit Function.
A field with a size or duration type unit would be used to format the values in the Link
Analyze chart, addfields
, histograms and the Link table. In the
following example, Data Transfer
and Average Duration
are automatically formatted based on the specified unit:
'Log Source' = 'OCI API Gateway Access Logs'
| link 'OPC Request ID'
| stats avg('Content Size Out') as 'Total Bytes',
avg(Duration) as 'Duration (sec)',
unique(Status) as Status
| eval 'Data Transfer' = unit('Total Bytes', byte)
| eval 'Average Duration' = unit('Duration (sec)', sec)
| fields -'Duration (sec)', -'Total Bytes'
| classify 'Start Time', 'Average Duration',
'Data Transfer', Status as 'API Gateway Logs'