I have http response codes, and I have hosts.
I want my data to show both of them and how they correlate with each other, I am trying to picture what this would look like, but am having trouble.
Basically this is my search:
index=nitro_ecomm_rest http_Response_code="*" |table host http_Response_code
This shows me every host and every response code.
I would like something more along the lines of every response code with the percentage of a host that is in it so if host: alpha50 has 10 200 http responses and 90 400s under 200, it would show alpha50 10% 10 and under the 400 category 90% 90
This is something I will also be working on for a bit.
Give this a try
index=nitro_ecomm_rest http_Response_code="*" | stats count by host http_Response_code | eventstats sum(count) as Total by host | eval Percent=round(count*100/Total,2) | eval ValueToShow=Percent." % - ".count | chart values(ValueToShow) over host by http_Response_code
Give this a try
index=nitro_ecomm_rest http_Response_code="*" | stats count by host http_Response_code | eventstats sum(count) as Total by host | eval Percent=round(count*100/Total,2) | eval ValueToShow=Percent." % - ".count | chart values(ValueToShow) over host by http_Response_code
Try this
index=nitro_ecomm_rest http_Response_code="*" | chart count over host by http_Response_code