I have this search query:
base search
| eval error = if(type="error",1,0)
| eval pageView = if(type="pageView",1,0)
| timechart sum(error)/sum(pageView) as ratio
But ratio doesn't work. Is there a way to see that ratio?
base search
| eval error = if(type="error",1,0)
| eval pageView = if(type="pageView",1,0)
| bin _time span=1h
| stats sum(error) as errorSum sum(pageView) as pageViewSum by _time
| eval ratio=errorSum / pageViewSum
| timechart values(ratio) as ratio
Pick an appropriate span
hi @bmezhibovskiy,
You can calculate the ratios after the counting.
| bin span=30m _time
| chart count(eval(type="error")) as error, count(eval(type="pageView")) as pageView by _time
| eval ratio=error/pageView
This works, but it shows 3 graphs, which makes the graph useless since the ratio is between 0 and 1, and there are thousands of events. How do I only show a graph of the ratio?
Just remove the fields error and pageView with this at the end
| fields - error pageView
"doesn't work" is not a good problem description.
Part of the problem is the timechart command cannot do math like the query is trying to do. Try doing the math in an eval statement before timechart.
base search
| eval error = if(type="error",1,0)
| eval pageView = if(type="pageView",1,0)
| eval ratio = round(error/pageView,3)
| timechart max(ratio) as ratio