How can I graph percent fails by host over time?

[skiller1234]

OK - I can't get this simple chart to work. Just need to graph Percent Fails by host over time

this is my start right now

index=app sourcetype=app_source source=*source.log "failedfor" OR "worked"
| bucket span=30m _time
| eval bad=if(searchmatch("failedfor"),1,0)
| stats count as total sum(bad) as bad by host
| eval conversion=(bad/total)*100

I can get like variations of the correct stats, but not charted by time and host (% over 30m plot points)..

thank you!
shawn

[DalJeanis]

You almost had it. In order to chart across time ( timechart ), you need the _time field.

Your stats command does not include the _time field, so the field stopped existing after that command.

Change to ...

  | stats count as total sum(bad) as bad by host _time