My base search is just building a timechart of 3 utilization rates over time. Two rates come from one source, one from another via a join. Seems to work fine.
index=XXXX sourcetype="XXXX"
| eval Booked_tilization=substr(BookedUtilization , 1, len(BookedUtilization )-1)
| eval mytime=strptime(MonthYear, "%m/%d/%Y")
| eval _time=mytime
| eval "Room GUID"=substr(SynergyID , 1, len(SynergyID )-10)
| lookup XXXXXX.csv "Room GUID"
| join type=outer "System Name" [search index=XXXX sourcetype="XXXXX" | rename "Endpoint Name" as "System Name"]
| timechart span=1mon eval(round(avg(BookedUtilization),2)) as "Booked Utilization %" eval(round(avg(PanelUtilization),2)) as "Panel Utilization %" eval(round(avg('Utilization Rate'),2)) as "VC Utilization %"
![alt text][1]
However, if I specify a room number, the first two still work but the third breaks and gives you a repeating number. The number it gives (36.85) is the average for that room over all months.
![alt text][2]
Any guidance is appreciated!
[1]: /storage/temp/254691-cusersgirfonedrive-chevronpictures1.jpg
[2]: /storage/temp/254693-cusersgirfonedrive-chevronpictures2.jpg
↧