Using count as a field for calculation

[DerekKing]

Hi,

I have a field "scanned_hosts" that has a value (say 20), and I also have a number of events, which to my understanding is the built in field count.

What I would like to do is create a radial gauge that is a percentage calculation of the two fields. so I want to do something like

index=blah source=blah | eval mypercentage = 100*(count/scanned_hosts) | gauge mypercentage

I can't use my command as it appears I dont have count available to use in the way that I want to use it, and stats count AS mycount doesnt give me what i'm looking for either.

Any Help would be appreciated

Thanks
Derek.

[alacercogitatus · Accepted solution]

count is only generated during a statistical command.

Try this:

index=blah source=blah | stats count max(scanned_hosts) as scanned_hosts | eval mypercentage = 100 * ( count / scanned_hosts ) | gauge mypercentage

[DerekKing]

Thanks very much. I think you have just cleared up a long time misunderstanding. "count is only generated during a statistical command".

The above works, and is exactly what I was looking for - thanks.

Derek.