consider this search:
source=bandwidth | timechart sum(packets_in) by host
which will produce rows indexed by a timestamp, and columns headed by hostnames.
I'd like to scale values in each column via division by the average of that column.
How should I go about it?
Assuming 1hr buckets
| bin span=1h _time
| stats sum(packets_in) as packets_in by host _time
| eventstats avg(packets_in) as avg_in by host
| eval packets_in=packets_in/avg_in
| xyseries _time host packets_in
View solution in original post