Hi,
I am trying to plot the percentage data over a period of span 1h.
host="abc" sourcetype="xyz" ("Eurl" ) | eval series1 = "Request" | append [search host="abc" sourcetype="xyz" ("Esuccess") | eval series2 = "Success"] | stats count(series1) as s1, count(series2) as s2 | eval pct=(s2*100/s1) | timechart span=1h avg(pct)
I am able to see the PCT value in one row, which is not helping the cause. I am looking for PCT data for every 1 hour.
This query does not return result if I add timechart. Not sure about the reason.
Please help.
... View more