Hi
It look like spath
calculates its percentage based on the number of available events instead on the number of occurrences of the checked value. For example if I have the next event (did not include the metadata):
{"test": [{"t": 1}, {"t": 2}, {"t": 2}]}
spath will say that the interesting field test{}.t
consists of 2 values and that the value 2 appears in 200% of events (value 1 appears in 100%). This is a very confusing, why not check it against the number of the occurrences of test{}.t
(Perhaps there is a way to do it and I missed it).
| makeresults
| eval _raw="{\"test\": [{\"t\": 1}, {\"t\": 2}, {\"t\": 2}]}"
| spath
| stats count by test{}.t
HI, @electronicsplunk
How about this?