Search code examples
sumologic

Can't divide field by number in Sumo Logic

I have a sumo logic query where i'm taking a numeric field and summing it, but that fields value is milliseconds so I want to divide the field by 1000 to get the number as seconds.

parse "DownloadDuration=*," as DownloadTime | sum(downloadtime / 1000) as TotalDownloadTime

but sumologic gives me an error: Parse error: ')' expected but '/' found. when i try to do this (even though their help docs seem to suggest this is totally legit.

Solution

  • I had to add another parse statement to alter the fields value. 

    parse "DownloadDuration=*," as DownloadTime | 
(downloadtime / 1000) as DownloadTime | 
sum(downloadtime) as TotalDownloadTime

    Works perfectly!