https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rate-on-a-timechart-with-two-measures/m-p/387512#M113029 <P>Like this:</P> <PRE><CODE>index=_* component IN("Metrics", "PerProcess") | eval component=if(component=="Metrics", "released", "cancelled") | rename component as orderLineState | rename COMMENT AS "everything above generates sample events; everything below is your solution" | timechart count max(date_hour) AS m_node BY orderLineState | eval cancelRate=round(('count: cancelled' / ('count: cancelled' + 'count: released')) * 100, 2) </CODE></PRE> Sat, 13 Jul 2019 21:53:30 GMT woodcock 2019-07-13T21:53:30Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rate-on-a-timechart-with-two-measures/m-p/387510#M113027 <P>Works just fine</P> <PRE><CODE>| timechart count by orderLineState | eval cancelRate=round((cancelled/(cancelled+released))*100,2) </CODE></PRE> <P>But when I add a second measure in the time chart I can't figure out how to get values I need back out for the cancelRate</P> <PRE><CODE>| timechart max(node) as m_node count by orderLineState | eval cancelRate=round((cancelled/(cancelled+released))*100,2) </CODE></PRE> Sat, 13 Jul 2019 18:47:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rate-on-a-timechart-with-two-measures/m-p/387510#M113027 taynord 2019-07-13T18:47:33Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rate-on-a-timechart-with-two-measures/m-p/387511#M113028 <P>Pay attention to the field names produced by the timechart, likely <CODE>count: cancelled</CODE> etc.</P> <PRE><CODE>... | eval cancelRate = round(('count: cancelled' / ('count: cancelled' + 'count: released')) * 100, 2) </CODE></PRE> Sat, 13 Jul 2019 20:22:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rate-on-a-timechart-with-two-measures/m-p/387511#M113028 martin_mueller 2019-07-13T20:22:46Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rate-on-a-timechart-with-two-measures/m-p/387512#M113029 <P>Like this:</P> <PRE><CODE>index=_* component IN("Metrics", "PerProcess") | eval component=if(component=="Metrics", "released", "cancelled") | rename component as orderLineState | rename COMMENT AS "everything above generates sample events; everything below is your solution" | timechart count max(date_hour) AS m_node BY orderLineState | eval cancelRate=round(('count: cancelled' / ('count: cancelled' + 'count: released')) * 100, 2) </CODE></PRE> Sat, 13 Jul 2019 21:53:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-rate-on-a-timechart-with-two-measures/m-p/387512#M113029 woodcock 2019-07-13T21:53:30Z