Oh, I see, I think I got it, just need to practice more lol. But thanks Sukisen for the responses and explanations. It helped a lot.
Just to let you know or maybe help someone in the future. My current code is like this, (showing all the values as a percentage by time as well):
<search>
| bin _time span=1h
| stats sum(FAIL) as "Total Fails" sum(PASS) as "Total Passes" sum(TOTAL_VOLUME) as Total by
CLIENT, _time, SERVICE
| fields CLIENT, "Total Fails", "Total Passes", SERVICE, Total, _time
| eval {SERVICE}=Total
| fillnull value=0
| fields - SERVICE
| stats sum(*) by CLIENT, _time
| rename sum(* as ""*
| rename *) as *%""
| rename "Total %" as Total
| eval "Total Fails"='Total Fails%', "Total Passes"='Total Passes%'
| fields _time, CLIENT, *, "Total Passes", "Total Fails", Total
| rename _time AS "Date:Hour"
| convert timeformat="%m/%d:%H" ctime("Date:Hour")
| sort -"Total Passes"
| head 5
| foreach *%
[eval <<FIELD>>=round(('<<FIELD>>'/Total)*100,2)]
Thank you again!
... View more