Currently I have
index=* Name=rateA OR rateB OR rateC OR rateD OR rateE | stats sum(Rate) as sumRate by _time, Name
What I want to do is get the sumRate of all the other rates and then divide them by rateE 's sumRate. I tried doing an appencols to search for rateE separately and then do appendcols [search index=* Name=rateE | stats sum(Rate) as sumRateE by _time, Name ] | eval divided=sumRate/sumRateE
but for some reason the time range of the appendcols search was only a fraction of the total time range.
try this:
index=* Name=rateA OR Name=rateB OR Name=rateC OR Name=rateD OR Name=rateE
| stats sum(Rate) as sumRate, sum(eval(if(Name="rateE",Rate,0))) as sumRateE by _time
| eventstats sum(sumRate) as sumRate sum(sumRateE) as sumRateE
| eval divided=sumRate/sumRateE
Hi sorry I should I clarified in my questions, how do I then timechart the average divided for each name as a percent? When I try
... | eval divided=sumRate/sumRateE
| timechart avg(divided) as Percent by Name
I don't get anything showing up
Using the eval in the stats line I get both sumRateE and sumRate, then using eval to divide:
index=* Name=rateA OR rateB OR rateC OR rateD OR rateE
| stats sum(Rate) as sumRate, sum(eval(if(like(Name,"rateE"),Rate,0))) as sumRateE by _time
| eval divided=sumRate/sumRateE