Hi,
I am trying to show the difference in percentage between two values in my log: Tx_Mbps and Input_Rate_Mbps and display the percentage as a Single Value. When I used the query below in the "Search & Reporting" I noticed that there is a difference between verbose (I get 44%) and fast(i get 68%) mode.
Then when i applied this query in my dashboard, i always get 68%. So i assume it is not in verbose mode. Is there any way to force my dashboard to search in verbose mode?
These are the things i tried:
Used eventstats instead and added "|fields *|". I tried this in all positions throughout the query. I still get non-verbose results
Saw a suggested solution to add this in my dashboard simpleXML: "param name="searchModeLevel"verbose". Able to advise where should i add this in? I tried adding this in the tag within my panel. Still get non-verbose results
This is my query in the dashboard:
sourcetype=csv index=*portstats* OR index=*q_health* | eval Tx_Mbps=max(Tx_Mbps,0) | eval Input_Rate_Mbps=max(Input_Rate_Mbps,0) | stats avg(Tx_Mbps) as h avg(Input_Rate_Mbps) as q | eval diff = ((h-q)/q)*100 | table diff
Thanks in advance!
... View more