@niketn
to detail my question I have this for the moment :
| eval myHour=strftime(_time, "%H")
| fields title timed_out response_code
| fillnull value=600 response_code
| eval response_code=if(response_code="",600, response_code)
| eval success=case(response_code>=402, 0, timed_out == "True", 0)
| fillnull value=1 success
| timechart span=5m min(success) as dispo_every_5m, max(response_code) as max_response_code
| eval availability=case(myHour>0 and myHour < 1 and availability=="KO",availability." Maintenance", dispo_every_5m==1,"OK", dispo_every_5m==0,"KO")
| fields availability max_response_code
| timechart span=5m sum(max_response_code) by availability
(the new values don't appear :/)
... View more