How to use a formula

The Expression Builder that you see in Log Explorer, Metrics Explorer, or Monitor creation works with two concepts: query and formula. It defaults to a single simple query (A) that you modify to shape data as you need. By clicking Add query, you can introduce another data set and shape it as needed (B). Clicking Add formula allows you to do math between these queries.

For example, given access logs with an action field, you might use query A to timechart action=* and query B to timechart action=denied. You could then add a formula of A / B to produce a timechart showing the percentage of denied actions.