Hi,
try this search:
| makeresults | eval CollectionName="Foo,Bar" | fields - _time | makemv delim="," CollectionName | mvexpand CollectionName
| eval PercentageUsed=round(random() % 1000/10,1)
| eval PercentageFree=100-PercentageUsed | eval Percentages=PercentageFree.",".PercentageUsed
| makemv delim="," Percentages | mvexpand Percentages | eval Label=if(PercentageFree=Percentages,"Free","Used")
| table Label,CollectionName,Percentages | xyseries Label,CollectionName,Percentages
In the first line I just recreate your data and add some random usages in the second.
The third line introduces a new field PercentageFree as 100-used, because you want two slices per graph. Now, this is where the going gets tough: You combine the two values into one Percentages field, turn it into multivalue and split them into two events. In effect you duplicate every event, because you want one event showing the free value and one with the used.
Now, the next step is to introduce a Label field that will hold the "Free/Used" to be used as label. Since our MV field Percentages was split into two distinct values, one per event, we do this with a simple if. If you have more values to cope with... use case or lookup instead.
Almost done: Use table to get rid of all unwanted information and xyseries to transpose the fields into the right form for the trellis.
Hope it helps.
Oliver
... View more