Add a percentage row into a chart?

[ganinurceski]

Hello there!

I want to add a percentage row into a chart table.

string:
index=smsc tag=MPRO_PRODUCTION DATA="8000000400000000" OR "8000000400000058" | dedup DATA | chart count by SHORT_ID, command_status_code | search NOT ESME_RTHROTTLED=0 | sort - ESME_RTHROTTLED | head 15

And the chart table:

The red result, is what i need to add. the Value in it should be calculated like the blue marked.
ESME_RTHROTTLED value get divided by ESME_RTHROTTLED and ESME_ROK together.
Can someone help me?

[richgalloway · Accepted solution]

You're asking for a column, not a row. Columns can be created with the eval command.

... | eval "THROTTLING %" = ESME_RTHROTTLED / (ESME_ROK + ESME_RTHROTTLED) * 100

[ganinurceski]

Does this add the column automatically in the chart table?

[mydog8it]

It will add the desired column to your results. However your sample data uses 223/(ESME_ROK + ESME_RTHROTTLED) * 100 as the formula. If that is right the search should be...

your_search | eval "THROTTLING %"=(223/(ESME_RTHROTTLED + ESME_ROK)*100)

[ganinurceski]

Thx! it worked!