For some reasons, I could not get the right result using your query. ... View more

I did this it seems to work for now. index=os sourcetype="interfaces" host="prdcg4mdbl03.oss.prd" | multikv | eval PercError_PacketLoss=round(((Error * 100)/(RXbytes+TXbytes)),1) | eval StatusError = if(PercError_PacketLoss >= 1.0, "WARNING", "OK") | eval PercRX_PacketLoss=round(((RXdropped * 100)/RXbytes),1) | eval PercTX_PacketLoss=round(((TXdropped * 100)/TXbytes),1) | eval StatusRX = if(PercRX_PacketLoss >= 1.0, "WARNING", "OK") | eval StatusTX = if(PercTX_PacketLoss >= 1.0, "WARNING", "OK") | table time Name StatusError PercError_PacketLoss StatusRX PercRX_PacketLoss StatusTX PercTX_PacketLoss ... View more

Hi Jon, Thanks for your fast response. I really appreciated that. The result is not what I expected. I am looking for the delta. Something like this. 456 - 123 = 333 ... View more