I am trying to a radial gauge to report a percentage. I've built my search and the field that I want to report on has 4 different values.
I have my basic search and then the following:
| stats count by myfield | gauge count by myfield=normal*
which gives me a gauge value of 4 but that only reflect the total different values of the field "severity".
I've tried to place an eval but it doesn't take
| stats count myfield1 as (search severity=normal)
| stats count myfield2 as (search severity="*")
| eval myfield=100*(myfield1/myfield2)
| gauge myfield
... View more