Percent timechart

[Camilleri]

I'm currently using this query to display a chart with two lines: the TotalItems and the number of Mismatches.

index=app sourcetype="someSource" | timechart count(method) as TotalItems, count(Mismatch) as Mismatches

I need to display the percent of mismatches (mismatches*100/totalItems) of the two lines. Any tips would be really appreciated.

[somesoni2 · Accepted solution]

Just add an eval statement with your desired calculation, like this

index=app sourcetype="someSource" | timechart count(method) as TotalItems, count(Mismatch) as Mismatches | eval PercentMismtach=round(Mismatches*100/TotalItems,2)

[Camilleri]

Thank you!