How to display percentages with time duration data in timechart to visualize performance changes?

[mcomfurf]

We have an image processing service, and from the service logs I can calculate the duration in seconds of processing time for a given image. When we make hardware or software changes I want to be able to visualize performance changes. It's easy to do a time series of counts, but I've been asked to do so for a percentage instead.

My search to get overall percentages, again fairly easy:

sourcetype="imagelogs"  | eval duration=ceil(duration+(_time-(strptime(lastmodifiedtime,"%Y-%m-%d %H:%M:%S")))) | where duration < 86400  | rangemap field=duration "0-5 min"=0-299 "5-10 min"=300-599 "10-15 min"=600-899 "15-60 min"=900-3599 "60+ min"=3600-9999999  | top limit=5 range showcount=false percentfield=Percentage

The top search command seems to be incompatible with timechart. Do I need to construct a whole series of eval command within the timechart command to replace the rangemap function?

[strive]

Try this

Your Base Search with out Top command | stats count as Count count(eval(range="0-5 min")) as Count5min count(eval(range="5-10 min")) as Count10min count(eval(range="10-15 min")) as Count15min count(eval(range="15-60 min")) as Count60min count(eval(range="60+ min")) as Count60Plus by _time | eval Percent5min=Count5min*100/Count | eval Percent10min=Count10min*100/Count | eval Percent15min=Count15min*100/Count | eval Percent60min=Count60min*100/Count | eval Percent60plus=Count60plus*100/Count | timechart partial=false first(Percent5min) as "0-5 min" first(Percent10min) as "5-10 min" first(Percent15min) as "10-15 min" first(Percent60min) as "15-60 min" first(Percent60plus) as "60+ min"

You can add options like span and etc.. to timechart as per your needs