I am trying to count click through, the percent of total clicks over total searches.
index=basesearch action=click OR action=search
|stats count by action
What I really want is a percent number of action=clicks divided by action=search. What command do i use?
Try this:
<yourbasesearch> | stats count(eval(action="click")) as clickCount, count(eval(action="search")) as searchCount | eval percentage = clickCount/searchCount
Try this:
<yourbasesearch> | stats count(eval(action="click")) as clickCount, count(eval(action="search")) as searchCount | eval percentage = clickCount/searchCount