I'm trying to build a simple SPL query to display the max, min, range (difference), and percent of the difference to the max value.
index=myindex source="mysource"| stats max(count), min(count), range(count)|rename max(count) to "Max", min(count) to "Min", range(count) to "Difference"
Tried using the perc(y) stats function with no luck... Also tried some basic math which blows up every time..
range(count) \ max(count)*100
Thanks for your help in advance.
↧