I am trying to write a search, like Requests per second and its percentage based on total count. Please help me out in this. Thank you...
Try this
index=someindex "priceRequest" |rex "some-app/(?<methodName>[a-zA-Z]*)" | rex "processingTime: (?<RTIME>[0-9]*)" | eval RTIME_SEC=(RTIME/1000) | eval group = case(RTIME_SEC < 1, "1 sec", RTIME_SEC < 2,"2 sec", RTIME_SEC < 3,"3 sec", RTIME_SEC < 4,"4 sec",RTIME_SEC < 5,"5 sec",RTIME_SEC < 6,"6 sec",RTIME_SEC>6,"Time Out")| stats count by group,methodName| eventstats sum(count) as total by methodName | eval Perc=round(count*100/total,2) | chart values(count) values(Perc) over group by methodName | appendpipe [| stats sum(*) as * | eval group="Total" | table group *]
Try this
index=someindex "priceRequest" |rex "some-app/(?<methodName>[a-zA-Z]*)" | rex "processingTime: (?<RTIME>[0-9]*)" | eval RTIME_SEC=(RTIME/1000) | eval group = case(RTIME_SEC < 1, "1 sec", RTIME_SEC < 2,"2 sec", RTIME_SEC < 3,"3 sec", RTIME_SEC < 4,"4 sec",RTIME_SEC < 5,"5 sec",RTIME_SEC < 6,"6 sec",RTIME_SEC>6,"Time Out")| stats count by group,methodName| eventstats sum(count) as total by methodName | eval Perc=round(count*100/total,2) | chart values(count) values(Perc) over group by methodName | appendpipe [| stats sum(*) as * | eval group="Total" | table group *]
@somesoni2, yes i mean , interchange the columns.
here having 2 requests like priceRequest & priceResponse. actually having query for 1,2 columns are percentages of both requests and 3,4 column are count of both requests respectively. But i am expecting the query as like as Count(priceRequest ) Percentage(priceRequest ) Count(priceResponse) Percentage(priceResponse) respectively...
@somesoni2, Please help me out here for interchange the location of fields
Not sure if I understand what you need? What is the search that you're trying (before the appendpipe) and what is the fieldnames that you see?
how to add the Total field (row) in bottom of all adding all column values
You can use addcoltotals command for that. (add to the end)