Following is the data I have:
What I am trying to do is to show a ratio of the two delay classes with corresponding time limitations (like the ones seen in the example) based on the number of occurrences.
So, for example, on the 4th of June all of the combined NumberOfOccurances for the delay class of "B. > 15 MIN" are 50000, while all of the combined (summed) NumberOfOccurances on the same day for a corresponding delay class "A. < 15MIN" are 1000000, so I'd like to see the ratio of 0,05 shown in a Pivot table of visualization of some sort. How do I achieve that?
Sure, here is an example
source="CombinedA.csv" host="DESKTOP-NNPLERL" sourcetype="csv" DELAY_CLASS="*325*"
| bin span=1d _time
| stats sum(NumberOfOccurances) as NumberOfOccurances by _time DELAY_CLASS
| eval limitation=substr(DELAY_CLASS,5,len(DELAY_CLASS)-5)
| eval class=substr(DELAY_CLASS,1,1)
| eval {class}_count=NumberOfOccurances
| table limitation _time *_count
| stats values(*) as * by _time limitation
| eval ratio=A_count/B_count