Hi,
Sorry for the newbie question. We want to calculate percentage of time between 2 events over the entire search period. We use transaction and get the sum of time between each pair of events:
| transaction dest service startswith="CRITICAL;SOFT;1" endswith=OK | stats sum(duration) as total_downtime by dest
But we've no idea how to pass the earliest(_time) and latest(_time) of so that we can do the calculation like
percentage = (total_downtime/(latest-earliest))*100
Would anyone please help?
Thanks a lot.