I have a timechart for the last 7 days and I want to add a percentage of the two results returned from the timechart data. I know I need an eval to add a total of the two results and then divide the result of the value that I want the percentage by total. I think I would need a table to format the data into a column format.
index=ui_prod sourcetype=instrumentation processCode=NB (val1 OR val2) earliest=-7d latest=-1m | timechart span=1d count as Number_Clicks by dataValue
I want the end result to look like this:
_time val1 val2 Val2PercentofTotal
2015-07-20 7 3 30%
2015-07-19 160 40 20%
...........
Try something like this
index=ui_prod sourcetype=instrumentation processCode=NB (val1 OR val2) earliest=-7d latest=-1m | timechart span=1d count as Number_Clicks by dataValue | addtotals fieldname=Val2PercentofTotal val1 val2 | eval Val2PercentofTotal =round((val2*100)/Val2PercentofTotal,2)