I am using the below query to get the status codes of different applications which have one common functionality...I need to add the % by index.. Can someone please help me?
Thanks.
index=* sourcetype=access* URL="/bankapi/accounts/*/transactions/*/checkimages*" | top StatusCode by index
Below are the results...
index StatusCode count percent
bankapi_logs 200 616 98.402556
bankapi_logs 500 10 1.597444
olb_logs 200 5563 98.338342
olb_logs 500 52 0.919215
olb_logs 404 32 0.565671
olb_logs 503 10 0.176772
I need something like this...
index StatusCode count percent
bankapi_logs 200 616 98.402556
bankapi_logs 500 10 1.597444
BankAPI.Total 100
olb_logs 200 5563 98.338342
olb_logs 500 52 0.919215
olb_logs 404 32 0.565671
olb_logs 503 10 0.176772
OLB.Total 100
You could use appendpipe to use stats to add the statistics rows like this:
<existing query> | appendpipe [stats sum(percent) as percent by index] | sort index
You could use appendpipe to use stats to add the statistics rows like this:
<existing query> | appendpipe [stats sum(percent) as percent by index] | sort index
Version with more close to your expected format
index=* sourcetype=access* URL="/bankapi/accounts/*/transactions/*/checkimages*" | top StatusCode by index | appendpipe [stats sum(percent) as percent by index | eval index=upper(index)."_Total" | eval percent=round(percent)] | sort index
Thanks a lot.