How to show a timechart of a ratio of two sums?

[bmezhibovskiy]

I have this search query:

base search
| eval error = if(type="error",1,0)
| eval pageView = if(type="pageView",1,0)
| timechart sum(error)/sum(pageView) as ratio

But ratio doesn't work. Is there a way to see that ratio?

[ITWhisperer]

base search
| eval error = if(type="error",1,0)
| eval pageView = if(type="pageView",1,0)
| bin _time span=1h
| stats sum(error) as errorSum sum(pageView) as pageViewSum by _time
| eval ratio=errorSum / pageViewSum 
| timechart values(ratio) as ratio

Pick an appropriate span

[manjunathmeti]

hi @bmezhibovskiy,

You can calculate the ratios after the counting.

| bin span=30m _time 
| chart count(eval(type="error")) as error, count(eval(type="pageView")) as pageView by _time 
| eval ratio=error/pageView

[bmezhibovskiy]

This works, but it shows 3 graphs, which makes the graph useless since the ratio is between 0 and 1, and there are thousands of events. How do I only show a graph of the ratio?

[bowesmana]

Just remove the fields error and pageView with this at the end

| fields - error pageView

[richgalloway]

"doesn't work" is not a good problem description.

Part of the problem is the timechart command cannot do math like the query is trying to do.  Try doing the math in an eval statement before timechart.

base search
| eval error = if(type="error",1,0)
| eval pageView = if(type="pageView",1,0)
| eval ratio = round(error/pageView,3)
| timechart max(ratio) as ratio

[bmezhibovskiy]

That doesn't quite work. To be clear, this is a ratio of event counts.