I am trying to create an error percent tracker, but I cant get the eval command to generate a number. I have tried several search strings, these two seem to be the closest to success.
index="java" host="*tkn*" proxy\/listing | stats count as total | append [search index="java" host="*tkn*" proxy\/listing eventtype="java_exception*" OR eventtype="nix_errors" | stats count as error] | eval error_percentage=100*round(error/success,4) | fields error_percentage,error,total | rangemap field=error_percentage low=0-5 elevated=5-10 severe=10-100 default=0
index="java" host="*tkn*" proxy\/listing | stats count as total | search eventtype="java_exception*" OR eventtype="nix_errors" | stats count as error | eval error_percentage=100*round(error/success,4) | fields error_percentage | rangemap field=error_percentage low=0-5 elevated=5-10 severe=10-100 default=0
Success was a typo from the opposite query, was suppose to be total. The below answers all worked perfectly, thank you for the help
How do you get the value of success? With a append statement u wont be able to combine it to single event right?
I'm guessing you want to know what percentage of events from your base search have one of those two eventtypes?
Try something like this:
base search | stats count as total count(eval(match(eventtype, "^java_exception") OR eventtype="nix_errors")) as errors | eval error_percentage=100*round(errors/total,4)
If you like, you can pull the definition of what constitutes an error out of the stats, to get something like this:
base search | eval error=if(match(eventtype, "^java_exception") OR eventtype="nix_errors",1,0) | stats count as total sum(error) as errors | eval error_percentage=100*round(errors/total,4)
Try following
index="java" host="tkn" proxy/listing | eval hasError=if(eventtype="java_exception" OR eventtype="nix_errors","yes","no") | stats count(eval(hasError="yes")) as error, count as total | eval error_percentage=round(error*100/total,4) | rangemap field=error_percentage low=0-5 elevated=5-10 severe=10-100 default=0