Hi All,
how to calculate percentage value based on time intervals.here i am writting a query
index=operartions sourcetype="SView" OR sourcetype="YView" DashboardStatus="Success"
| timechart span=1d count(DashboardStatus) as Success by sourcetype
| appendcols
[ search index=operartions sourcetype="SView" OR sourcetype="YView" DashboardStatus="*"
| bucket _time span=1d
|stats count(eval(eventtype="YViewStatus" OR eventtype="SViewStatus")) as ClientSuccess count(DashboardStatus) as complete by _time
| eval percent=(ClientSuccess*100/complete)
|table percent
]
Here "YViewStatus" is the event type,it display the success records. "DashboardStatus" is the field type (Success/Failed).we are calculating the percentage based on the Success/Total events. using the above query there is a mismatch b/w time intervals,can u plz suggest the right query. thanks for advance.