source="file.txt" | transaction startswith="message1" endswith="message2" | stats count values(duration) as DUR
log file 5 events are matching
count DUR
5 0.095
0.056
0.075
0.064
0.095
I want to calculate the percentage of all events duration coming which is less than 75 miliseconds.
Please let me know how to go ahead.
You could replace your stats with something like this:
... | stats count as total count(eval(duration<0.075)) as count | eval percentage = count * 100 / total
You could replace your stats with something like this:
... | stats count as total count(eval(duration<0.075)) as count | eval percentage = count * 100 / total