Divide the results of a query based on a field in the log

[SG]

Hi,

I wanted to divide each hostname by using the count of "documentcompletetime" field.

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage"
| chart count(url) by hostname

The output of the query is as below...

The count(url) column I wanted to divide with the count of "documentcompletetime" field. This field is available in the events, screenshot for the same

I wanted to divide each and every value of count(url) column with "documentcompletetime" count which is 48 in this example. documentcompletetime value is not a static value. The value changes based on the test timings. Can you guys please help?

[aasabatini]

Hi @SG 

can you show the values of the documentcompletetime field?

also did you try this?

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage"
| chart count(url) by hostname documentcompletetime

[SG]

@aasabatini 

With the query provided by you, i am just getting the count of url by host name

hostname	NULL
cdn.appdynamics.com	47
digitalcontent.api.tesco.com	658
o505202.ingest.sentry.io	61
pdx-col.eum-appdynamics.com	1
smetrics.tesco.com	47
www.bing.com	705
www.googletagmanager.com	49
www.***.com	686

I also wanted to divide each and every value in the null column with the count of "documentcompletetime" .

For example 

hostname	NULL	documentcompletetime	count(url)
cdn.appdynamics.com	47	48	0.979167
digitalcontent.api.tesco.com	658	48	13.70833
o505202.ingest.sentry.io	61	48	1.270833
pdx-col.eum-appdynamics.com	1	48	0.020833
smetrics.tesco.com	47	48	0.979167
www.bing.com	705	48	14.6875
www.googletagmanager.com	49	48	1.020833
www.**.com	686	48	14.29167

[aasabatini · Accepted solution]

Hi @SG 

got it!

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage"
| eventstats dc(documentcompletetime) as documentcompletetime
| stats count(url) as count values(documentcompletetime) as documentcompletetime by hostname
| eval division=count/documentcompletetime
| table hostname count documentcompletetime division

[SG]

Thanks to @aasabatini  for the response, this is what i was looking for