I have a log where each event can be given a boolean field with:
| eval myfield=case(n > 0, "A", n=0, "B")
So some events have myfield = "A", others have myfield = "B", and others have myfield unset.
I'd like a graph with the X axis being "time" and the Y axis being the percentage of events that have n = "A" -- more specifically, the number of events that have n = "A" divided by number of events that have either (n = "A" or n = "B").
Also, for when you have more than two values going on, | addtotals will be more useful to you than | eval total=A+B. (Note that addtotals creates a field called 'Total' and field names are case-sensitive.)