I am using a simple query but want to display the data in percentage, There are 8 different sources for this query but in the dashboard my source is dynamic and input through a drop down and each dropdown has several subgroups and I wanto display the number of events in each source subgroup as %age. For example for below I have
source=123.a/123.b/123.c
and in verbose mode I can see the %age logging for all the source but is there a way to display it in the dashboard?
index=abc host=xyz source= 123*
| stats count by source, host
Try using eventstats in combination with stats, here is an example with data from the internal index:
index=_internal
| stats count by sourcetype
| eventstats sum(count) AS total
| eval pct = round((count / total) * 100 , 2)." %"
Try modifying command using eval command
| eval age = round((age/total_age)*100,1)