Example Search:
Index=*
|chart count over Character
|addcoltotals
Example output:
A.................21
B.................13
C.................54
D.................11
....................99
Is it possible to take the addcoltotals
and divide it by the value of C (54/99) using an eval func?
@Romeo_James ,
Try,
index=*
|chart count over Character
|eventstats sum(count) as Total
|addcoltotals
|eval X=if(Character=="C",count/Total,"")|fields - Total
You can remove the condition, if you want the values for all characters
@Romeo_James ,
Try,
index=*
|chart count over Character
|eventstats sum(count) as Total
|addcoltotals
|eval X=if(Character=="C",count/Total,"")|fields - Total
You can remove the condition, if you want the values for all characters