I am trying to create a timechart for a query that returns a count for a set of products that where it's lifecycle status is either compliant or our of compliance. the count is then used to create a percentage. The query returns the two counts (which i don't care about) and the associated percentage for each (which is what do want to get into a time chart for the past 90 days. I have the search working but have not been able to figure out how to get the percents (two lines, one chart) into a timechart. Below is my search any help would be appreciated. What i have so far does return a count of events but nothing in a chart and the search itself says no results found
index="index" sourcetype=productversion (( removablemedia_win OSType="Windows*" AND LifeCycleStatus!="NewVersion") OR NOT ProductName="")
| stats count(LifeCycleStatus) AS lifecycletotal
| join type=outer OSType [search index="index" sourcetype=productversion (NOT ProductName="" (OSType="Windows*")) OR ( removablemedia_win AND (OSType="Windows*") AND (LifeCycleStatus="Mainstream" OR LifeCycleStatus="Emerging")) | stats count(LifeCycleStatus) AS IsCompliant]
| eval Compliant=(IsCompliant/lifecycletotal)*100
| eval Compliant=round(Compliant,2)
| eval NonCompliant=(100-Compliant)
| eval NonCompliant=round(NonCompliant,2)
| timechart span=1d first(Compliant) as Compliant first(NonCompliant) as NonCompliant
... View more