my search query :
index=index1"PrepareResponseTime= "
| rex "PreResponseTime= (?[0-9]*) ms"
| where PrepareResponseTime > 1000
| eval PrepareResponseTime= "count >1000"
| stats count by index,PrepareOrderResponseTime
| append [search index=index2 "PrepareResponseTime= "
| rex "PrepareResponseTime= (?[0-9]*) ms"
| where PrepareResponseTime < 1000 | eval PrepareResponseTime= "count <1000"
statistics results:
indexname PrepareResponseTime count
========= =================== =====
index1 count >1000 1486
index2 count <1000 6639
I would like to using eval calculate percentage like below:
(1486 * 100) / (1486 + 6639) = %
148600/8125 = 18.289 (round)
After using calculations results to be like :
round 18.29%
... View more