I have a log file that always has the same structure of:
time1,time2,groupNumber
eg:
355350224,338837556,2
1355350228,338837557,2
1355312572,338828143,2
1355350212,338837553,2
1355350216,338837554,2
1355350220,338837555,2
1355350224,338837556,2
1355310304,338827576,2
I want to group the times into buckets of a 1 hour span and then take the resulting count in each of those buckets and divide them by a number lets say 60.
So assume i have 10 items during the 12am-1am window on 12/12 and 5 items during the 1am-2am window on 12/12
This will give me a resulting table looking like:
Time | FunctionEvaluation
12/12 12am | .16667
12/12 1am | .08333
I was able to get close with:
source = Data _raw=",,4" | timechart span=1h count
but i couldn't perform a math operation
and with this i wasn't able to breakdown by time:
source = Data | rex field=_raw ".,.,(?\d+)" | top 20 groupNumber | sort groupNumber | eval reliability = (1 - (count/12960))*100 | fields groupNumber, reliability
