Hello there!
I want to add a percentage row into a chart table.
string:
index=smsc tag=MPRO_PRODUCTION DATA="8000000400000000" OR "8000000400000058" | dedup DATA | chart count by SHORT_ID, command_status_code | search NOT ESME_RTHROTTLED=0 | sort - ESME_RTHROTTLED | head 15
And the chart table:
The red result, is what i need to add. the Value in it should be calculated like the blue marked.
ESME_RTHROTTLED value get divided by ESME_RTHROTTLED and ESME_ROK together.
Can someone help me?
You're asking for a column, not a row. Columns can be created with the eval
command.
... | eval "THROTTLING %" = ESME_RTHROTTLED / (ESME_ROK + ESME_RTHROTTLED) * 100
You're asking for a column, not a row. Columns can be created with the eval
command.
... | eval "THROTTLING %" = ESME_RTHROTTLED / (ESME_ROK + ESME_RTHROTTLED) * 100
Does this add the column automatically in the chart table?
It will add the desired column to your results. However your sample data uses 223/(ESME_ROK + ESME_RTHROTTLED) * 100 as the formula. If that is right the search should be...
your_search | eval "THROTTLING %"=(223/(ESME_RTHROTTLED + ESME_ROK)*100)
Thx! it worked!