I use the timechart to analyze the data and I want to normalize the data in the timechart
... | timechart span=3d count by step
What I get is like:
_time 1 2 3
11/2 2 3 4
11/3 3 4 5
And I want to divide the max value of each row and get like this:
_time 1 2 3
11/2 0.5 0.75 1
11/3 0.6 0.8 1
How can I get this? Thank a lot in advance
Try something like this:
…| bucket span=3d _time | stats count by _time step
| eventstats max(count) as max by _time
| eval count=round(count/max,2)
| xyseries _time step count
bucket also works for me ! Thank you very much!
... | timechart span=3d count by step
| untable _time step count
| eventstats max(count) as max_count by _time
| eval count=round(count/max_count,1)
| xyseries _time step count
It does works! Thank you very much!