- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Romeo_James
Engager
10-05-2018
06:28 AM
Example Search:
Index=*
|chart count over Character
|addcoltotals
Example output:
Char ........Count
A.................21
B.................13
C.................54
D.................11
....................99
Is it possible to take the addcoltotals
and divide it by the value of C (54/99) using an eval func?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

renjith_nair
Legend
10-05-2018
03:01 PM
@Romeo_James ,
Try,
index=*
|chart count over Character
|eventstats sum(count) as Total
|addcoltotals
|eval X=if(Character=="C",count/Total,"")|fields - Total
You can remove the condition, if you want the values for all characters
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

renjith_nair
Legend
10-05-2018
03:01 PM
@Romeo_James ,
Try,
index=*
|chart count over Character
|eventstats sum(count) as Total
|addcoltotals
|eval X=if(Character=="C",count/Total,"")|fields - Total
You can remove the condition, if you want the values for all characters
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
