I have two different sources, each with information related to one another. The first source has, as part of the file, every successful page hit. The second source, has, as part of the file, every error report.
index= sourcetype=< st> source= < hit log > < some further conditions >
| stats count as total_hits
| appendcols [search index= sourcetype=< st> source= < error log > < some otherfurther conditions >
| stats count as total_errors ]
If I do a search like this, I successfully get the count of crashes, count of successes, and can do an eval FailureRate= total_hits/total_errors
However, I want to further do a timechart to see the failure rate over time, and this is where I am stuck. How would I propagate time throughout this process to build a timechart of a single value?