timechart ratio by model

[sarathipattam]

Hi,

below is my query

index_ sourcetype=main
| stats count(eval(level="Error")) as ERRORS count(eval(level="Information")) as USAGE by Model osVersion firmware
|eval RATE=round(((EXCEEDED/REQUEST)*100),1)

and I want to time chart the ratio by this three coloums/dimensions Model, osVersion, firmware.

Can someone assist me please?

[sarathipattam]

concatenate is not working for me

[sarathipattam]

i used strcat and it worked.. thank you!!

[somesoni2 · Accepted solution]

I'm assuming there is a typo in the field names in the eval for RATE field (should be ERRORS/USAGE), so using the correct names, try like this (whatever timespan you want to use for time chart, update the same in bin and timechart command, below uses timespan of 1h or 1 hour)

index_ sourcetype=main
| bin span=1h _time
| stats count(eval(level="Error")) as ERRORS count(eval(level="Information")) as USAGE by _time Model osVersion firmware
|eval RATE=round(((ERRORS/USAGE)*100),1)
| eval Model_osVersion_firmware=Model."/".osVersion."/".firmware
| timechart span=1h avg(RATE) by Model_osVersion_firmware