In the timechart docs, the following example was provided:
sourcetype=access_* | timechart count(eval(method="GET")) AS GET, count(eval(method="POST")) AS POST
What if I want to calculate the GetPercentage such that
eval GetPercentage=(GET/(GET+SUCCESS) * 100)
and have that displayed in the timechart? The result should be something like:
_time GetPercentage
1/6/2013 34.5
1/7/2013 22.5
You can do this by adding your eval
after the timechart
command.
sourcetype=access_* | timechart count(eval(method="GET")) AS GET, count(eval(method="POST")) AS POST | eval GetPercentage=(GET/(GET+SUCCESS) * 100)
Thanks! I also want to get a timechart of the GetPercentage by API. I don't want the GET or POST to show because I want to later create a line chart with just the GetPercentage by API. I started with the following but I can't insert the 'by API' in the eval clause:
sourcetype=access_* | timechart count(eval(method="GET")) AS GET, count(eval(method="POST")) AS POST | eval GetPercentage=(GET/(GET+SUCCESS) * 100) | fields - GET, POST
Expected output is something like:
_time getCustomerName(GetPercentage) getCustomerAge(GetPercentage)
1/6/2013 34.5 22.9
1/7/2013 22.5 33.7