creating a report that shows indexedtime vs logged time for each hour in percentage.

[mrtolu6]

I want to create a chart separated by hours (24hours) that shows the number of data that took more than 2 mins to be indexed (indextime-time) and converted into percent. The percent would be the total event that took over 2mins to be indexed divided by the total number of events for that hour.(for that 1 hour span)

This is the basic search I'm using to calculate the events over 2mins
index=nameoftheindex | eval time=_time | eval indextime=_indextime | eval diff=indextime-time | where diff>=120 | convert ctime(indextime) | convert ctime(time) fields sourcetype indextime time diff

Any help would be helpful. Thanks

[DalJeanis · Accepted solution]

You can't use a where clause that eliminates all the events under 2 minutes, and then later get a percentage of the total, because you don't have the total.

Here's one way...

earliest=-24h@h latest=@h index=nameoftheindex 
| eval GT2=if(_indextime-_time>=120,1,0)
| bin _time span=1h
| stats avg(GT2) as PctGT2 by _time

...or just ...

earliest=-24h@h latest=@h index=nameoftheindex 
| eval GT2=if(_indextime-_time>=120,1,0)
| timechart avg(GT2) as PercentGreaterThan2minutes 

[mrtolu6]

Thanks DalJeanis that worked. How do I add "%" at the end of PctGT2 results and also move the decimal space to places to the right?

[DalJeanis]

earliest=-24h@h latest=@h index=nameoftheindex
| eval GT2=if(_indextime-_time>=120,1,0)
| bin _time span=1h
| stats avg(GT2) as PctGT2 by _time
|eval PctGT2 = round(PctGT2*100,2)."%"