Ok, so I want to see the ratio between "interview.completed" and "interview.started", but filtering each event by unique interviewCode
Currently, each separate search looks like this:
Search for unique interviews started:
source="http:Tracker" | spath "message.environment" | search "message.environment"=production | spath eventName | search eventName="pre-record.candidate.interview.start" | spath interviewCode | search interviewCode=* | dedup interviewCode | timechart span=1w count by eventName
Result 6
Search for unique interviews completed:
source="http:Tracker" | spath "message.environment" | search "message.environment"=production | spath eventName | search eventName="pre-record.candidate.interview.completed" | spath interviewCode | search interviewCode=* | dedup interviewCode | timechart span=1w count by eventName
Result 1
How can I create a chart that displays both values side by side?
Try this
source="http:Tracker" | spath "message.environment" | search "message.environment"=production | spath eventName | search eventName="pre-record.candidate.interview.start" OR eventName="pre-record.candidate.interview.completed"| spath interviewCode | search interviewCode=* | dedup eventName interviewCode | timechart span=1w count by eventName
Try this
source="http:Tracker" | spath "message.environment" | search "message.environment"=production | spath eventName | search eventName="pre-record.candidate.interview.start" OR eventName="pre-record.candidate.interview.completed"| spath interviewCode | search interviewCode=* | dedup eventName interviewCode | timechart span=1w count by eventName
It looks like you might be able to just take where you do
... | search eventName="pre-record.candidate.interview.start"
and
... | search eventName="pre-record.candidate.interview.completed"
And combine them into one where you search for either.
... | search eventName="pre-record.candidate.interview.start" OR eventName="pre-record.candidate.interview.start
That should get you both on one set of results.
Hi Rich, thanks for your reply.
I have tried using "OR" but the result of that query is only one number and what I want is a chart where I can see both numbers:
Interviews started by unique interviewCode = 6
Interview completed by unique interviewCode = 1
Meaning my completion rate is 1/6 = 16%