Can you please tell me, how to do daily percentage, here is the overall percentage query,
index="idxweblog" source="/opt/apache2/logs/surf.nbcuni.com-access_log" c=cnbc "/api/login" | eval rt9xxms=if(duration > 900000,1,0) | stats sum(rt9xxms) as rt9xxms count(duration) as Total | eval rt9xxmsPercentage=(Total - rt9xxms)*100/Total | eval rthighPercentage=(100-rt9xxmsPercentage)
Try this
index="idxweblog" source="/opt/apache2/logs/surf.nbcuni.com-access_log" c=cnbc "/api/login" | bucket span=1d _time | eval rt9xxms=if(duration > 900000,1,0) | stats sum(rt9xxms) as rt9xxms count(duration) as Total by _time | eval rt9xxmsPercentage=(Total - rt9xxms)*100/Total | eval rthighPercentage=(100-rt9xxmsPercentage)
THis will give you the percentage day-wise (_time will be set as YYYY-mm-dd 00:00 AM). If you want to format _time, add following to above search:-
above search | eval Date=strftime(_time,"%Y-%m-%d") | fields - _time
seems this query works for me, is there any other way to get this shortly.
index="idxweblog" source="/opt/apache2/logs/surf.nbcuni.com-access_log" c=cnbc "/api/login" | bin _time span=1d | eval rt9xxms=if(duration <= 900000,1,0) | stats sum(rt9xxms) as rt9xxms count(duration) as Total by _time | eval rt9xxmsPercentage=(Total - rt9xxms)*100/Total | eval rthighPercentage=(100-rt9xxmsPercentage) | table _time, rthighPercentage
Try this
index="idxweblog" source="/opt/apache2/logs/surf.nbcuni.com-access_log" c=cnbc "/api/login" | bucket span=1d _time | eval rt9xxms=if(duration > 900000,1,0) | stats sum(rt9xxms) as rt9xxms count(duration) as Total by _time | eval rt9xxmsPercentage=(Total - rt9xxms)*100/Total | eval rthighPercentage=(100-rt9xxmsPercentage)
THis will give you the percentage day-wise (_time will be set as YYYY-mm-dd 00:00 AM). If you want to format _time, add following to above search:-
above search | eval Date=strftime(_time,"%Y-%m-%d") | fields - _time
how to add this with timechar with formatted date? we can take only two column _time and rthighPercentage.
this query working formore than a day. if we choose a particular day, seems its giving blank entries. can you please correct this query to avoid blank entries.
index="idxweblog" source="/opt/apache2/logs/surf.nbcuni.com-access_log" c=cnbc "/api/login" | bucket _time span=1d | top duration limit=0 by _time | where duration <= 900000 |timechart sum(percent) as reliability