@dmoberg The query correctly aligns Percentage, Count, route, and method on the same rows, addressing your original issue. | makeresults count=10 | streamstats count AS row_number | eval rout...
See more...
@dmoberg The query correctly aligns Percentage, Count, route, and method on the same rows, addressing your original issue. | makeresults count=10 | streamstats count AS row_number | eval route=case(row_number=1, "*.html", row_number=2, "*.html", row_number=3, "*.css", row_number=4, "*.js", row_number=5, "*", row_number=6, "*.html", row_number=7, "*.html", row_number=8, "*.html", row_number=9, "*", row_number=10, "*"), method=case(row_number=1, "GET", row_number=2, "HEAD", row_number=3, "GET", row_number=4, "GET", row_number=5, "GET", row_number=6, "POST", row_number=7, "OPTIONS", row_number=8, "POST", row_number=9, "POST", row_number=10, "GET"), Count=case(row_number=1, 50, row_number=2, 30, row_number=3, 30, row_number=4, 30, row_number=5, 15, row_number=6, 12, row_number=7, 10, row_number=8, 5, row_number=9, 6, row_number=10, 6) | eventstats sum(Count) AS Total | eval Percentage = round((Count / Total) * 100, 2) | table Percentage, Count, route, method | sort - Percentage