How to search the average percentage of two different stats and display both on the same timechart?

[bgeshk]

I'm having trouble displaying the count of 400-499 errors as 1 series on a timechart, and 500-599 errors as a separate series on a timechart. Ideally they will display the average error percentage spanning every 5 minutes. This is what I have:

index="......" | stats count(eval(error>=400 AND error <500)) as _400errors, count as totalEvents
| eval perc400=(_400errors/totalEvents) * 100
| stats count(eval(error>=500 AND error <600)) as _500errors 
| eval perc500=(_500errors/totalEvents) * 100
| timechart span=5m avg(perc400) avg(perc500)

Can someone explain what I'm doing wrong? Thank you

[somesoni2]

Well so many things 😉 ...

Try like this

your base search 
| eval Error400=if(error>=400 AND error <500,1,0) | eval Error500=if(error>=500 AND error <600,1,0)
| timechart span=5m count as totalEvents sum(Error400) as Error400 sum(Error500) as Error500
| eval perc400=(Error400/totalEvents) * 100  | eval perc500=(Error500/totalEvents) * 100
| fields - Error*