so i have done this:
index="windows-wmi" sourcetype="wmi:DiskRAMLoad" Name="mfetp.exe"
| head 10
| stats avg(ReadOperationCount) as mfetp_ReadOperation_AVG, avg(ReadTransferCount) as mfetp_ReadTransfer_AVG, avg(WriteOperationCount) as mfetp_WriteOperation_AVG, avg(WriteTransferCount) as mfetp_WriteTransfer_AVG
| appendcols
[ search index="windows-wmi" sourcetype="wmi:DiskRAMLoad" Name="mfetp.exe"
| head 10
| stats avg(ReadOperationCount) as mfetp_ReadOperation_AVG2, avg(ReadTransferCount) as mfetp_ReadTransfer_AVG2, avg(WriteOperationCount) as mfetp_WriteOperation_AVG2, avg(WriteTransferCount) as mfetp_WriteTransfer_AVG2]
| eval percReadOperation_AVG=round((mfetp_ReadOperation_AVG/mfetp_ReadOperation_AVG2)*100,2),
percReadTransfer_AVG=round((mfetp_ReadTransfer_AVG/mfetp_ReadTransfer_AVG2)*100,2),
percWriteOperation_AVG=round((mfetp_WriteOperation_AVG/mfetp_WriteOperation_AVG2)*100,2),
percWriteTransfer_AVG=round((mfetp_WriteTransfer_AVG/mfetp_WriteTransfer_AVG2)*100,2)
but there is an issue somewhere because the result is a big number even if i do the test in my local pc
so it means for example that i divise 50/50 so the increase is 0%..... What can i do please??
... View more