Mark the Unit for a Field at Query Time

Use the unit( ) function of the eval command to mark the unit of a field in the Link user interface.

For a complete list of the supported units, see Supported Types for the unit Function.

A field with a size or duration type unit would be used to format the values in the Link Analyze chart, addfields, histograms and the Link table. In the following example, Data Transfer and Average Duration are automatically formatted based on the specified unit:

'Log Source' = 'OCI API Gateway Access Logs'
| link 'OPC Request ID' 
| stats avg('Content Size Out') as 'Total Bytes',
        avg(Duration) as 'Duration (sec)',
        unique(Status) as Status
| eval 'Data Transfer'     = unit('Total Bytes', byte)
| eval 'Average Duration'  = unit('Duration (sec)', sec)
| fields -'Duration (sec)', -'Total Bytes'
| classify 'Start Time', 'Average Duration', 
          'Data Transfer', Status as 'API Gateway Logs'

Mark the unit for a field during Query Time