I have this search that I'm using streamstats with to show agents upgrading
source=client_data COMPUTER_NAME="*" AGENT_VERSION="*"
| streamstats current=0 window=1 global=f last(AGENT_VERSION) as AgentVersion1 by COMPUTER_NAME
| where AGENT_VERSION!=AgentVersion1
I'm trying to calculate out the rate that they are upgrading to get estimations for completion and overall reporting of progress.
Anyone have any suggestions on how I can turn this into a speed/progress meter?
How about this...
source=client_data COMPUTER_NAME="" AGENT_VERSION=""
| streamstats current=0 window=1 global=f last(AGENT_VERSION) as AgentVersion1 by COMPUTER_NAME
| timechart span=1h count(eval(AGENT_VERSION!=AgentVersion1)) as tbd count(eval(AGENT_VERSION=AgentVersion1)) as done by COMPUTER_NAME | eval rateofcompletion=3600/done | eval timetocomplete=tbd*rateofcompletion | eval timetocomplete=tostring(timetocomplete, "duration")