不能在Sumo Logic中按字段划分

Question

我有一个相扑逻辑查询，其中我取一个数字字段并对其进行求和，但是该字段值是毫秒，所以我想将字段除以1000以得到秒数。< / p>

parse "DownloadDuration=*," as DownloadTime | sum(downloadtime / 1000) as TotalDownloadTime

但sumologic给我一个错误：Parse error: ')' expected but '/' found.当我尝试这样做时（即使他们help docs seem to suggest this is totally legit。

Answer 1

我必须添加另一个parse语句来更改字段值。

parse "DownloadDuration=*," as DownloadTime | 
(downloadtime / 1000) as DownloadTime | 
sum(downloadtime) as TotalDownloadTime

完美无缺！