Works just fine
| timechart count by orderLineState
| eval cancelRate=round((cancelled/(cancelled+released))*100,2)
But when I add a second measure in the time chart I can't figure out how to get values I need back out for the cancelRate
| timechart max(node) as m_node count by orderLineState
| eval cancelRate=round((cancelled/(cancelled+released))*100,2)
Pay attention to the field names produced by the timechart, likely count: cancelled
etc.
... | eval cancelRate = round(('count: cancelled' / ('count: cancelled' + 'count: released')) * 100, 2)
Like this:
index=_* component IN("Metrics", "PerProcess")
| eval component=if(component=="Metrics", "released", "cancelled")
| rename component as orderLineState
| rename COMMENT AS "everything above generates sample events; everything below is your solution"
| timechart count max(date_hour) AS m_node BY orderLineState
| eval cancelRate=round(('count: cancelled' / ('count: cancelled' + 'count: released')) * 100, 2)
Pay attention to the field names produced by the timechart, likely count: cancelled
etc.
... | eval cancelRate = round(('count: cancelled' / ('count: cancelled' + 'count: released')) * 100, 2)