My base search is just building a timechart of 3 utilization rates over time. Two rates come from one source, one from another via a join. Seems to work fine.
index=XXXX sourcetype="XXXX"
| eval Booked_tilization=substr(BookedUtilization , 1, len(BookedUtilization )-1)
| eval mytime=strptime(MonthYear, "%m/%d/%Y")
| eval _time=mytime
| eval "Room GUID"=substr(SynergyID , 1, len(SynergyID )-10)
| lookup XXXXXX.csv "Room GUID"
| join type=outer "System Name" [search index=XXXX sourcetype="XXXXX" | rename "Endpoint Name" as "System Name"]
| timechart span=1mon eval(round(avg(BookedUtilization),2)) as "Booked Utilization %" eval(round(avg(PanelUtilization),2)) as "Panel Utilization %" eval(round(avg('Utilization Rate'),2)) as "VC Utilization %"
However, if I specify a room number, the first two still work but the third breaks and gives you a repeating number. The number it gives (36.85) is the average for that room over all months.
Any guidance is appreciated!
