How to edit my chart/timechart search to include the sum of events?

[clintla]

sourcetype=pools

Fields- poolname, poolsize

sourcetype=poolcomponents 

Fields- componentname, poolname, componentsize, componentused, componentfree

I'd like to run something like (I know the pools field is a single event for multi poolcomponents events)

Sourcetype=pool* <-- I can see all my fields
chart sum(componentsize)/poolsize) as "Percent Pool Utilized" by poolname <-- to get a % used of the all the pools

I'd like it to be flexible where I can eventually timechart & predict these results.

Is there a simple way to do this?

[DalJeanis]

I generally like to run the records together and massage them step by step before feeding them to the charting components. Try this for any one particular pool and see if the number looks right...

sourcetype=pool* poolname="testpoolname"
| stats sum(poolsize) as poolsize, sum(componentsize) as componentsum by poolname 
| eval poolpct=componentsum/poolsize
| rename poolpct as  "Percent Pool Utilized"

In order to use a timechart, you'd have to have a time component in the data which you haven't listed. The above search isn't selecting by time, so if your records are replaced over time as the process advances, then we'd need to account for that.

I'm a bit fuzzy on the details of what you are trying to predict. Pool...components...utilized... all together suggest a construction application, or possibly a kid's party planner. If you provide more details, then we can give more salient advice.

[clintla]

If I add up the components, I can see the total space taken up in a pool.

My device doesnt do a good job of capacity reporting & I'd like to just add up all components every day & compare them to their associated pools & calculate their usage.

Should

| eval poolpct=componentsum/poolsize
| rename poolpct as "Percent Pool Utilized"

be adding another column to the chart?