I have a search | timechart span=h count | streamstats count as row
that gives me 24 rows: (1 full day at an hourly level)
_time count row
1 2016-02-20 00:00 2 1
2 2016-02-20 01:00 2 2
...
23 2016-02-20 22:00 2 23
24 2016-02-20 23:00 2 24
what I want to do is get a total of the count and then divide this by (NumberOfRows*2)*100
| timechart span=h count | stats sum(count) as total | eval percent=total/24*2*100
which will give me:
total percent
1 48 100
How do I set NumberOfRows to be a variable storing the number of rows dynamically, 24 for 1 day, or if I do it for 2 days it would be 48 ....etc.
Or is there a better way of doing this?
I feel like there's probably a better way to accomplish what you're trying to get after, but it's late and my brain is shutting down. But to answer your question maybe, I think this should work.
| timechart span=h count | stats sum(count) as total dc(_time) as numRows | eval percent=total/numRows*2*100
that should get you the distinct count of values for _time, which after the timechart should be one for each row.
I feel like there's probably a better way to accomplish what you're trying to get after, but it's late and my brain is shutting down. But to answer your question maybe, I think this should work.
| timechart span=h count | stats sum(count) as total dc(_time) as numRows | eval percent=total/numRows*2*100
that should get you the distinct count of values for _time, which after the timechart should be one for each row.
tks, | timechart span=h count | stats sum(count) as total dc(_time) as numRows | eval percent=total/(numRows*2)*100
just had to add the brackets.