I have a query below that is showing "PriceChangeCount", "Total" and "PriceChangeRate" in graph, How can I get the graph that only displays the PriceChangeRate in graph?
index=xxx sourcetype=xxx|eval priceChangeCnt=case(Id=xxx,"Yes") | timechart span=1h count as Total, count(priceChangeCnt) as PriceChangeCount | eval PriceChangeRate=(PriceChangeCount/Total)*100
try this:
index=xxx sourcetype=xxx
|eval priceChangeCnt=case(Id=xxx,"Yes")
|bin _time span=1h
| stats count as Total, count(priceChangeCnt) as PriceChangeCount by _time
| eval PriceChangeRate=(PriceChangeCount/Total)*100
| timechart span=1h max(PriceChangeRate) as m_PriceChangeRate
hope it helps
try this:
index=xxx sourcetype=xxx
|eval priceChangeCnt=case(Id=xxx,"Yes")
|bin _time span=1h
| stats count as Total, count(priceChangeCnt) as PriceChangeCount by _time
| eval PriceChangeRate=(PriceChangeCount/Total)*100
| timechart span=1h max(PriceChangeRate) as m_PriceChangeRate
hope it helps
Hi adonio, many thanks! It works well.