Field statistics/chart on extracted number showing NAN?

I created a regex extractor against a firewall syslog message similar to this string smtp-proxy[2155]: msg_id=“1BFF-000F” Allow rcvd_bytes=“7885” sent_bytes=“6333” and when I search for the msg_id, the expanded message shows smtp_rcvd_bytes: 7885.

The extractor includes the conversion to numeric at the bottom yet when I bring up the field statistics for smtp_rcvd_bytes I only get the count - all fields except for cardinality show NAN so I can’t graph this value either.

This is what the extractor shows:

Will only attempt to run if the message includes the string msg_id=“1BFF-000F”
regex_value: rcvd_bytes="([0-9]+)"

Make sure that the message fields you want to analyze are numeric over the complete time range of the query.

You can create a custom index template to enforce a data type:

it was the timeframe, some of the results being returned didn’t have the extracted values.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.