Looking for some assistance with trying to fix my search to calculate percentage on several columns.
Here is what I am trying to see:
Count 3sec 3to10sec 10to30sec
X X X X
Percent X% X% X%
Here is my search so far:
sourcetype="mcafee:wg:kv"
| rangemap field=time_total "0-3sec"=0-3000, "3-10sec"=3001-10000, "10-30sec"=10001-30000, "30sec-1min"=30001-60000, "1min-5min"=60001-300000, "5min-10min"=300001-600000, default=">10min"
| stats count as Count count(eval(range="0-3sec")) as 3sec count(eval(range="3-10sec")) as 3to10sec count(eval(range="10-30sec")) as 10to30sec count(eval(range="30sec-1min")) as 30secto1min count(eval(range="1min-5min")) as 1minto5min count(eval(range="5min-10min")) as 5minto10min count(eval(range=">10min")) as grt10min
Like this:
sourcetype="mcafee:wg:kv"
| eval time_total_buckets=case(time_total<=3000, "0-3sec",
time_total<=10000, "3-10sec",
time_total<=30000, "10-30sec",
time_total<=60000, "30sec-1min",
time_total<=300000, "1min-5min",
time_total<=600000, "5min-10min",
true(), ">10min")
| top limit=0 time_total_buckets
| addtotals row=f col=t
| fillnull value="TOTAL"
| multireport
[ fields - percent | eval RowType="count" ]
[ fields - count | rename percent AS count | eval RowType="percent"]
| xyseries RowType time_total_buckets count
works great... thanks!
Be sure to click Accept
to close the question.