I have created a choropleth map, but the values on the map shown is "avg_duration". I want to have the value instead be "one". I think the problem might be because the "one" field was created through an eval. Any help is much appreciated, thanks!
sourcetype=apache host="*ucd"|
transaction tip, sid startswith="ucd-web/start" endswith=(x="landingready")|
geoip tip|
stats avg(duration) by tip_country_name |
rename avg(duration) as avg_duration |
join [search sourcetype=apache host="*ucd" |
transaction tip, sid startswith="ucd-web/start" endswith=(x="landingready") |
geoip tip |
stats avg(duration) as "total_avg" ] |
eval one=total_avg-avg_duration |
geom geo_countries featureIdField=tip_country_name
... View more