A have two tables anda i want to relation this two tables by nember of events in a hour, i manage to make a SQL query, but struggle to do in splank. I send the data of this 2 tables for two diferent indexes (simple copy) and want to make this:
WITH count_reserved as (
SELECT count (ru.id) reserved,
to_char(ru.date,'yyyy-mm-dd hh24') as time
FROM reserved ru
GROUP BY to_char(ru.date,'yyyy-mm-dd hh24')
),
count_concluid as (
SELECT count (u.id) as concluid,
to_char(u.date,'yyyy-mm-dd hh24') as time
FROM concluid u
GROUP BY to_char(u.date,'yyyy-mm-dd hh24')
)
SELECT coalesce(concluid,0) as concluid,
reserved,
count_reserved.time,
((coalesce(concluid::decimal,0)/reserved)*100) as percentage
FROM count_reserved
LEFT JOIN
count_concluid
ON count_concluid.time=count_reserved.time
ORDER BY 3 ASC
the information that a want to return is the percentage value and the time to make a graph hour bar
... View more
