sumologic - 无法在 Sumo Logic 中按数字划分字段

Question

我有一个相扑逻辑查询，我在其中获取一个数字字段并将其求和，但该字段值是毫秒，所以我想将该字段除以1000以秒为单位。

parse "DownloadDuration=*," as DownloadTime | sum(downloadtime / 1000) as TotalDownloadTime

但是 sumologic 给了我一个错误：Parse error: ')' expected but '/' found.当我尝试这样做时（尽管他们的帮助文档似乎表明这是完全合法的。

Answer 1

我不得不添加另一个parse语句来更改字段值。

parse "DownloadDuration=*," as DownloadTime | 
(downloadtime / 1000) as DownloadTime | 
sum(downloadtime) as TotalDownloadTime

完美运行！