DNS Cache hit ratio (CHR) per DNS view

[#1]

Quite often, we see grid configuration with multiple DNS views, so how to report on DNS Cache hit ratio (CHR) per DNS view? Here it is:

sourcetype=ib:dns:query:cache_hit_rate index=ib_dns | eval PERCENT=if(HITS+MISSES > 0,(HITS*100/(HITS+MISSES)),0) | bucket span=10m _time | timechart bins=1000 avg(PERCENT) as CHR by display_name | interpolate 1200

[#2]

What would the querry look like if I wanted to check the CHR for different members on the same graph?

Thanks

[#3]

Hi Shamir,

Here you are:

sourcetype=ib:dns:query:cache_hit_rate index=ib_dns | eval PERCENT=if(HITS+MISSES > 0,(HITS*100/(HITS+MISSES)),0) | eval host_view = host." ".display_name | bucket span=10m _time | timechart bins=1000 avg(PERCENT) as CHR by host_view | interpolate 1200

[#4]

Thank you! That was very helpful.