I have two query
1: sourcetype=A error=499
2: sourcetype=B X=*
I would like to make timechart of % of A on B.
Basically I want to make timechart that will tell if error code increase is because of volume decrease etc,
( sourcetype=A error=499) OR (sourcetype=B X=*)
| timechart count by sourcetype
| eval perc= round(A / B * 100,2)
| fillnull