Append column to timechart, that is a function of existing columns.

[wlbaird]

I have a timechart with columns A and B, I would like to add a third column C, where C=A/B

My timechart is created by:

index=...

| timechart span=10m count(_raw) AS A

| appendcols [ index= ....

| timechart span=10m count(_raw) AS B]

[kamlesh_vaghela]

@wlbaird 

You can try some thing like this also.

index="..." OR index="...." | timechart span=10m sum(eval(if(index="...",1,0))) as A  sum(eval(if(index="....",1,0))) as B | eval C=A/B

My Sample Search :

index="_internal" OR index="_introspection" | timechart span=10m sum(eval(if(index="_internal",1,0))) as A  sum(eval(if(index="_introspection",1,0))) as B | eval C=A/B

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
 

[wlbaird]

Thanks that worked. 

[ITWhisperer]

index=...
| timechart span=10m count(_raw) AS A
| appendcols [ index= ....
| timechart span=10m count(_raw) AS B]
| eval C=A/B