Ok, so I want to see the ratio between "interview.completed" and "interview.started", but filtering each event by unique interviewCode
Currently, each separate search looks like this:
Search for unique interviews started:
source="http:Tracker" | spath "message.environment" | search "message.environment"=production | spath eventName | search eventName="pre-record.candidate.interview.start" | spath interviewCode | search interviewCode=* | dedup interviewCode | timechart span=1w count by eventName
Result 6
Search for unique interviews completed:
source="http:Tracker" | spath "message.environment" | search "message.environment"=production | spath eventName | search eventName="pre-record.candidate.interview.completed" | spath interviewCode | search interviewCode=* | dedup interviewCode | timechart span=1w count by eventName
Result 1
How can I create a chart that displays both values side by side?
... View more