While I was trying to generate a dashboard on chronicle, Can’t use sum as ${events__additional__fields.value__string_value} is a string value need to convert it into number or integer form
You can cast the string you are using into a number just by using the to_number function in your table calculation. So just update it to:
to_number(${ events_additional_fields.value_string_value})
You can see the documentation for table calculation functions here.
But in table calculation you won’t get to see the UDM fields directly
What are UDM fields?
You put to_number in the wrong place. You need to put it around the string value only, not around the ‘if’ statement. If you look at my first message, it shows you were it should go.
Thanks Gavin, But look into the error message on the right side
I would suggest creating a table calc with just
to_number(${ events_additional_fields.value_string_value})
in it to see if it throws an error. Bear in mind the field you are using in a table calculation needs to be in the explore query you are running. It makes sense to build up table calcs in pieces and combine it together when you can see each piece works.
I can try to combine them but the actual problem is not with the format you are asking me to use the problem is that I am getting error with ${ events_additional_fields.value_string_value}
Is this field in your explore?
Thanks I think i solved it, field need to selected in the table then only you can perform the calculation
Can you help me with this how I can filter the data for just one day as you can see the “Sent Data in MB” is same for each line
It looks like you do not want the sum of the values (which would give what you see, the value for the whole table). If you just want the value for each row, take out the sum function.
I am trying to get the per hour or per day data of send bytes