I am calculating a health rate for projects based on specific criteria, generaly its the SUM of projects ranked A or B divided by the total number of projects. I am trying to display a timechart of the Health Score as a function of time but with no luck.
Here is my search:
basesearch
| streamstats values(pipelineRun{}) as pipelines dc(pipelineRun{}) as num_pipelines by fullPath
| spath path=project.Findings output=Findings
| mvexpand Findings
| spath input=Findings
| eval ProjectRank=mvappend(ProjectRank, case(A>0 OR B>9, "F",
A=1 OR (B<9 AND B>2) , "B",
A=0 AND B=0, "A"))
| eval PipelinesRank=mvappend(PipelinesRank, if(num_pipelines>8, "A", "F"))
| eval ProjectFinalRank=mvappend(ProjectFinalRank, case(ProjectRank="F" OR PipelinesRank="F", "F",
PipelinesRank="A" AND ProjectRank="B", "B",
PipelinesRank="A" AND ProjectRank="A", "A"))
| stats count by group ProjectFinalRank
| stats sum(eval(if(ProjectFinalRank="A" OR ProjectFinalRank="B",count,0))) AS HIGH sum(count) AS Total by group
| eval HealthRate=round(HIGH*100/Total,2)
