hello! This is probably a simple answer that I'm not understanding.
Running the query below will add a column at the very end called "success_rate". I don't want this since, since I've transposed that field to the first row. Seems like the eval from line 4 is still trying to calculate...? How do I get rid of it? | field - success_rate
doesn't work 😞
index=wsi_tax_summary sourcetype=stash partnerId=* error_msg_service=* tax_year=2019 capability=* intuit_tid=* capability=*
| eval error_msg_service = case(match(error_msg_service, "OK"), "Success", 1==1, "Fail")
| timechart span=1w dc(intuit_tid) by error_msg_service
| fillnull
| eval total=Fail+Success, success_rate=round(((Success/total)*100),2)
| fieldformat success_rate=tostring('success_rate')+"%"
| fields _time, total, Success, Fail, success_rate
| eval _time=strftime(_time,"%m-%d-%Y")
| transpose column_name="Week Starting" header_field=_time
| regex "Week Starting"!=("^_")
| fields - success_rate
I figured it out. It's the fieldformat
that's the constraint. I removed it and I achieved what I wanted.
I figured it out. It's the fieldformat
that's the constraint. I removed it and I achieved what I wanted.