How do I divide my other results from one specific result?

[sbentley_ea]

Currently I have

index=* Name=rateA OR rateB OR rateC OR rateD OR rateE | stats sum(Rate) as sumRate by _time, Name

What I want to do is get the sumRate of all the other rates and then divide them by rateE 's sumRate. I tried doing an appencols to search for rateE separately and then do appendcols [search index=* Name=rateE | stats sum(Rate) as sumRateE by _time, Name ] | eval divided=sumRate/sumRateE but for some reason the time range of the appendcols search was only a fraction of the total time range.

[mayurr98]

try this:

index=* Name=rateA OR Name=rateB OR Name=rateC OR Name=rateD OR Name=rateE 
| stats sum(Rate) as sumRate, sum(eval(if(Name="rateE",Rate,0))) as sumRateE by _time 
| eventstats sum(sumRate) as sumRate sum(sumRateE) as sumRateE 
| eval divided=sumRate/sumRateE

[sbentley_ea]

Hi sorry I should I clarified in my questions, how do I then timechart the average divided for each name as a percent? When I try

... | eval divided=sumRate/sumRateE
| timechart avg(divided) as Percent by Name

I don't get anything showing up

[solarboyz1]

Using the eval in the stats line I get both sumRateE and sumRate, then using eval to divide:

index=* Name=rateA OR rateB OR rateC OR rateD OR rateE 
| stats sum(Rate) as sumRate, sum(eval(if(like(Name,"rateE"),Rate,0))) as sumRateE by _time
| eval divided=sumRate/sumRateE