I'm trying to measure a rate of several different computers. The rate is measured from 0 to 100 and I want to know the distribution in performance over time. I would like a pie chart of the rates by percentages, as well as by count Here is my query:
| eventstats perc10(rate) AS 10p
| eventstats perc25(rate) AS 25pl
| eventstats perc50(rate) AS 50p
| eventstats perc75(rate) AS 75p
| eval ranking=case( rate <=10p_fill, 10, rate <=25p_fill, 25, rate <=50p_fill, 50, rate <=75p_fill, 75, 1=1,1 )
| stats count by ranking | sort + ranking
I am getting an "error in eval command, expression malformed, expected ). error. Can you please explain why and also if I am going about this the right way?