We need to determine a 30 day average based on the count of two events, a request and a response. The issue is that each generate upward of 30K each...hourly. The search below works great for short durations, but once the duration increases, the count data from the appendcols is all over the map.
Any ideas would be greatly appreciated!!
index=blah blah blah
| search field="A Response*"
| timechart span=1h count as response
| appendcols [ search field="A Request*"
| timechart span=1h count as request ]
| eval reciprocal=round(response/request,2)*100
... View more