Hello there,
My current code is giving me the following (if the screenshot is not clear, I provide the numbers later on):
By each row or 'campaign', it shows the counts of events that fell in each of the 3 buckets (i.e. 'glanced', 'read','skimmed'). The value of field "read_category" has the 3 buckets.
In the above picture, here are the numbers if the picture is blurry:
-First Campaign: glanced = 217, read=200, skimmed=196
-Second Campaign: glanced=1488, read = 1307, skimmed = 953
I would now like to add % on each row by bucket for the row. The sum of percentages on each row should add to 100%. Something like this:
How can I achieve this? I would appreciate any help. Thanks in advance!
My current code is:
sourcetype="xxx" source="yyy.log"
| eval read_category = case (
duration < 3,"glanced",
duration > 8, "read",
duration >= 3 AND duration <= 8, "skimmed"
)
| lookup cml_campaign_lookup_2018_12_11.csv deliveryid OUTPUT Campaign, sent_date
| table deliveryid, user, duration, clientIP, read_category, Campaign, sent_date
| chart count as total over Campaign by read_category
... View more