How to create a chart or table that shows results for multiply sourcetypes.

[mrtolu6]

I want to create a chart separated by hours (24hours) and grouped by the sourcetype that shows the number of data that took more than 2 mins to be indexed (indextime-time) and converted into percent. The percent would be the total event that took over 2mins to be indexed divided by the total number of events for that hour.(for that 1 hour span). The result shold be grouped by the sourcetype

This is the basic search I'm using to calculate the events over 2mins
earliest=-24h@h latest=@h index=nameoftheindex
| eval GT2=if(_indextime-_time>=120,1,0)
| bin _time span=1h
| stats avg(GT2) as PctGT2 by _time

[DalJeanis · Accepted solution]

earliest=-24h@h latest=@h index=nameoftheindex 
| eval GT2=if(_indextime-_time>=120,1,0)
| bin _time span=1h
| stats avg(GT2) as PctGT2 by _time sourcetype
| eval PctGT2=round(100*PctGT2,2)
| timechart avg(pctGT2) as pctGT2 by sourcetype

Technically, if you are going to use timechart, you wouldn't have to bin the _time and stats for the avg, since timechart will handle that in a single step.

earliest=-24h@h latest=@h index=nameoftheindex 
| eval GT2=if(_indextime-_time>=120,100,0)
| timechart span=1h avg(GT2) as pctGT2 by sourcetype