L.s., I want to get the latency from the input from a forwarder to an index. So whe use the app Meta_woot. It creates an inputlookup file meta-woot. In this file are the latest in-time and host names and index names. So far so good. Next is to use this file for calculating if a host is late or recent or delayed. Those searches are in the app and works fine. But i want a little extension, i want a table with the indexes as leading, and then calculate (by index) the percentage recent/late host, and sum it a one outcome (per index) So far the theory, now my tries. I used below serach. | inputlookup meta_woot where index=* | eval convert_late=(1440*60) | eval convert_delayed=(60*60) | eval last_time=(now()-recentTime) | eval last_time_indexed=case(last_time < convert_delayed, "Recent", last_time > convert_late, "Late", last_time > convert_delayed, "Delayed") | eval compliant_host=if(last_time_indexed="Recent", "1","0") | stats count(compliant_host) as chost by index, compliant_host This gives me a result where the outcome has split into indexname vs compliant_host and chost index compliant_host chost main 0 11 main 1 123 msad 1 6 nmon 1 5 openshift 1 1 temp_log 1 1 wineventlog 1 2 Now the question, how do i calculate the percentage for index main ( (123+11)/11) so i get an percentage value. How do i calculate with values after a stats command?? Pls help Thanx in advance greetz Jari
... View more