OK - I can't get this simple chart to work. Just need to graph Percent Fails by host over time
this is my start right now
index=app sourcetype=app_source source=*source.log "failedfor" OR "worked"
| bucket span=30m _time
| eval bad=if(searchmatch("failedfor"),1,0)
| stats count as total sum(bad) as bad by host
| eval conversion=(bad/total)*100
I can get like variations of the correct stats, but not charted by time and host (% over 30m plot points)..