Have a log with related event
One event has the number widgets made in the period and another event has the actual time taken to make the widgets in that period.
i can do a search and get a time chart of number of widgets and time used . But, what I want is a timechart of the actualtime/number of widgets made..
How do i construct a search to do that.
This? - Update your field names as necessary
search events
| timechart sum(number_of_widgets) as widget_count sum(creation_time) as creation_time