I am trying to use the above query, and plot a graph for the TPS field.
So, if I draw a chart with the TPS values over a day (duration) with a span of 1 min/hour, it would show a line graph over a day (duration).
Tried the following, didn't work (Change between **). What am I doing wrong?
host=X source=Y.log "data available" | stats min(_time) as EARLIEST
| appendcols [
search host=X source=Z.log ILIKEYO_KNOW WAR_RIGG_IS_BAD 5.7_WOLFER | stats max(_time) as LATEST ]
| appendcols [
search host=X source=Y | stats count(ITIM_ID) as count ]
**| timechart span=1d avg(eval(TPS=count/(LATEST-EARLIEST)))**
| eval EARLIEST=strftime(EARLIEST,"%Y-%m-%d %H:%M:%S")
| eval LATEST=strftime(LATEST,"%Y-%m-%d %H:%M:%S")
... View more