Dynamic label in Timelion doesn't work as expected

[Eduardo_De_Zulueta]

Hi,
I was trying to generate a Timelion graph using the split feature and also dynamic labels but the result is not as expected:

.es(index=transaction.es*, timefield='time',q='status:KO', split='site.keyword:10').multiply(100).divide(.es(index=transaction.es*, timefield='time',q='status:OK OR status:KO')).yaxis(2).label("[$1]", "^.* > site.keyword:(\S+) > .*")

my desired output is the KO ratio by site, and the actual output is:

As you can see int the graph the KO ratio for the site with higher volume is around 9% but its not real because the ratio for this site is around 50%

Then the split by site.keyword for all the sites is not OK, due to the ratio is calculated grouping all the sites.
Do you know any idea to solve it?

[Brandon_Kobel]

Hey @Eduardo_De_Zulueta, you'll want to add the "split" parameter to the second .es statement:

.es(index=transaction.es*, timefield='time',q='status:KO', split='site.keyword:10').multiply(100).divide(.es(index=transaction.es*, timefield='time',q='status:OK OR status:KO',split='site.keyword:10')).yaxis(2).label("[$1]", "^.* > site.keyword:(\S+) > .*")

[Eduardo_De_Zulueta]

Hi @Brandon_Kobel, thanks a lot, now it works perfect!