This gets me pretty close to what I need. I modified it slightly to get to the data I need: | makeresults format=csv data="Day,Percent
2024-11-01,100
2024-11-02,99.6
2024-11-03,94.2
2024-11-04, 79....
See more...
This gets me pretty close to what I need. I modified it slightly to get to the data I need: | makeresults format=csv data="Day,Percent
2024-11-01,100
2024-11-02,99.6
2024-11-03,94.2
2024-11-04, 79.9
2024-11-30, 49.9
2024-12-01,22.1
2024-12-02,19.0"
| eval _time=strptime(Day, "%F")
| foreach 50 80 100
[ eval REMAINING = 100 - <<FIELD>>
| eval REMEDIATION_<<FIELD>> = if(Percent <= REMAINING, 1, null())]
| stats earliest_time(_time) as Start earliest_time(REMEDIATION_*) as r_* I'll need to figure out a way to get the 100% field to show up after the stats command but I know I can do that in a brute force manner if necessary. I haven't seen foreach before so thank you for such a concise, relevant example.