adding results from top query

[snookerfly]

Hi,

I've got a result table from a top query and want to add the results to compute an overall cache hit rate and feed this into either a time chart or pie chart for a dashboard.

Example:
action count percent
TCP_MISS 16438 55.479429
UDP_MISS 10627 35.866887
TCP_REFRESH_UNMODIFIED 797 2.689932
TCP_HIT 527 1.778663
TCP_MEM_HIT 487 1.64366
TCP_IMS_HIT 375 1.265652
TCP_REFRESH_MODIFIED 157 0.529886
TCP_MISS_ABORTED 143 0.482635
TCP_CLIENT_REFRESH_MISS 74 0.249755
TCP_HIT_ABORTED 2 0.00675

Add all numbers from the percent column that have either "HIT" or "UNMODIFIED" in the action column and feed this number to a pie or time chart.

[martin_mueller · Accepted solution]

How 'bout this?

your base search before the top call | eval cache_hit = if(match(action, "HIT|UNMODIFIED"), "hit", "miss") | top cache_hit

Feed that into a pie chart.