I was trying to generate a Timelion graph using the split feature and also dynamic labels but the result is not as expected:
.es(index=transaction.es*, timefield='time',q='status:KO', split='site.keyword:10').multiply(100).divide(.es(index=transaction.es*, timefield='time',q='status:OK OR status:KO')).yaxis(2).label("[$1]", "^.* > site.keyword:(\S+) > .*")
my desired output is the KO ratio by site, and the actual output is:
As you can see int the graph the KO ratio for the site with higher volume is around 9% but its not real because the ratio for this site is around 50%
Then the split by site.keyword for all the sites is not OK, due to the ratio is calculated grouping all the sites.
Do you know any idea to solve it?