Hi
It look like spath calculates its percentage based on the number of available events instead on the number of occurrences of the checked value. For example if I have the next event (did not include the metadata):
{"test": [{"t": 1}, {"t": 2}, {"t": 2}]}
spath will say that the interesting field test{}.t consists of 2 values and that the value 2 appears in 200% of events (value 1 appears in 100%). This is a very confusing, why not check it against the number of the occurrences of test{}.t (Perhaps there is a way to do it and I missed it).
... View more