hello
I timechart a lot of search in a table and it works perfectly
here is the result
But for the piece of code below I try to find a solution in order to be able to calculate a percentage between sign and eue2 and to timechart the results like above instead having a separate result for sign field and for eue2 result
| appendcols
[ search index=toto
| timechart span=1h dc(sign) as sign ]
| append
[ search index=toto
| timechart span=1h dc(eue2) as eue2]
I need something like this :
| eval perc=(sign/eueu2) | timechart values(p) span=1h
could you help please?
| transpose 0 header_field=KPI column_name=KPI
| eval percentage=round(100*sign/eue2,2)
| transpose 0 header_field=KPI column_name=KPI
| transpose 0 header_field=KPI column_name=KPI
| eval percentage=round(100*sign/eue2,2)
| transpose 0 header_field=KPI column_name=KPI