Hi,
I'm newbie here and read a little about my issue in docs and answers here but got no clue for now.
I've got couple of lines
eventtype=audit MEMBER IN (100,200)
| bucket _time span=2h
| eval glue = if(STATUS="SUCCESS", "SUCCESSes in ", "ERRORs in "). MEMBER
| chart count(CODE) OVER _time by glue usenull=false
| addtotals row=t col=f
| rename Total AS _total
| foreach * [eval "<<FIELD>>_%"=if(isnum('<<FIELD>>'), round('<<FIELD>>'/_total*100,2), null())]
They gave me
_time|ERRORs in 100|ERRORs in 200|SUCCESSes in 100|SUCCESSes in 200|ERRORs_% in 100|ERRORs_% in 200|SUCCESSes_% in 100|SUCCESSes_% in 200
2018-07-09 00:00|10|0|18|1|34.48|0.00|62.07|3.45
2018-07-09 02:00|0|0|4|8|0.00|0.00|33.33|66.67
2018-07-09 04:00|1|3|17|12|3.03|9.09|51.52|36.36
2018-07-09 06:00|16|10|43|82|10.60|6.62|28.48|54.30
2018-07-09 08:00|35|20|130|202|9.04|5.17|33.59|52.20
Unfortunately it's not what I would like to have.
What I would like to achieve - to have a percentage columns with correct values inside per each MEMBER per each STATUS for those MEMBERS not per all of them.
Moreover quantity of MEMBERS can be different
e.g.
_time|ERRORs in 100|ERRORs in 200|SUCCESSes in 100|SUCCESSes in 200|ERRORs_% in 100|ERRORs_% in 200|SUCCESSes_% in 100|SUCCESSes_% in 200
2018-07-09 00:00|10|0|18|1|35,71|0,00|64,29|100,00
2018-07-09 02:00|0|0|4|8|0,00|0,00|100,00|100,00
2018-07-09 04:00|1|3|17|12|5,56|20,00|94,44|80,00
2018-07-09 06:00|16|10|43|82|27,12|10,87|72,88|89,13
2018-07-09 08:00|35|20|130|202|21,21|9,01|78,79|90,99
I would be very grateful for any help
cheers
Greg
... View more