I have a log where each event can be given a boolean field with:
| eval myfield=case(n > 0, "A", n=0, "B")
So some events have myfield = "A", others have myfield = "B", and others have myfield unset.
I'd like a graph with the X axis being "time" and the Y axis being the percentage of events that have n = "A" -- more specifically, the number of events that have n = "A" divided by number of events that have either (n = "A" or n = "B").
How do I do that?
You can use eval's inside of the functions of the charting modules to check if something is true.
|timechart span=15m count as "Total_Events" count(eval(myfield="a")) as "Total_A" count(eval(myfield="b")) as "Total_B" | eval percent_a=Total_A/Total_Events | eval percent_b=Total_B/Total_Events | fields percent_a,percent_b
If you want to only see a ratio of A to B, simply replace the division of "total_events" with the respective value.
This should work.
<your search> | eval myfield=case(n > 0, "A", n=0, "B") | timechart count by myfield | eval total=A+B | eval Aperc=100*A/total | eval Bperc=100*B/total | fields _time Aperc Bperc
Also, for when you have more than two values going on, | addtotals
will be more useful to you than | eval total=A+B
. (Note that addtotals creates a field called 'Total' and field names are case-sensitive.)