Thanks for the reply!
I tried using the second eval to automatically calculate the percentage but it doesn't seem to be working, it is only showing the count for each field on the first eval command.
| eval tempo= case(
'netPerf.netOriginLatency'<2000, "Under 2s",
'netPerf.netOriginLatency'>2000 AND 'netPerf.netOriginLatency'<3000, "Between 2s and 3s",
'netPerf.netOriginLatency'>3000, "Above 3s")
| timechart span=1h count by tempo usenull=false
| eventstats sum(count) as total by _time
| eval percentage=count/total
_time
Above 3s
Between 2s and 3s
Under 2s
08/07/2024 00:00
109
588
19307
08/07/2024 01:00
113
530
14900
08/07/2024 02:00
6
128
5450
08/07/2024 03:00
22
122
2847
But this already helps, I can extract the results in csv and calculate the percentage on excel.
Appreciate the quick reply!
... View more