I'm having trouble displaying the count of 400-499 errors as 1 series on a timechart, and 500-599 errors as a separate series on a timechart. Ideally they will display the average error percentage spanning every 5 minutes. This is what I have:
index="......" | stats count(eval(error>=400 AND error <500)) as _400errors, count as totalEvents
| eval perc400=(_400errors/totalEvents) * 100
| stats count(eval(error>=500 AND error <600)) as _500errors
| eval perc500=(_500errors/totalEvents) * 100
| timechart span=5m avg(perc400) avg(perc500)
Can someone explain what I'm doing wrong? Thank you
Well so many things 😉 ...
Try like this
your base search
| eval Error400=if(error>=400 AND error <500,1,0) | eval Error500=if(error>=500 AND error <600,1,0)
| timechart span=5m count as totalEvents sum(Error400) as Error400 sum(Error500) as Error500
| eval perc400=(Error400/totalEvents) * 100 | eval perc500=(Error500/totalEvents) * 100
| fields - Error*