using variables in a search + to store number of rows

[HattrickNZ]

I have a search | timechart span=h count | streamstats count as row
that gives me 24 rows: (1 full day at an hourly level)

_time   count   row
1   2016-02-20 00:00    2   1
2   2016-02-20 01:00    2   2
...
23  2016-02-20 22:00    2   23
24  2016-02-20 23:00    2   24

what I want to do is get a total of the count and then divide this by (NumberOfRows*2)*100

| timechart span=h count | stats sum(count) as total | eval percent=total/24*2*100 which will give me:

total   percent
1   48  100

How do I set NumberOfRows to be a variable storing the number of rows dynamically, 24 for 1 day, or if I do it for 2 days it would be 48 ....etc.
Or is there a better way of doing this?

[maciep · Accepted solution]

I feel like there's probably a better way to accomplish what you're trying to get after, but it's late and my brain is shutting down. But to answer your question maybe, I think this should work.

| timechart span=h count | stats sum(count) as total dc(_time) as numRows | eval percent=total/numRows*2*100

that should get you the distinct count of values for _time, which after the timechart should be one for each row.

[HattrickNZ]

tks, | timechart span=h count | stats sum(count) as total dc(_time) as numRows | eval percent=total/(numRows*2)*100 just had to add the brackets.