Hi,
I'm looking to grab numbers of http responses (status) as "Good" or "Bad" and am successful with the following query in which I can get Total number of Responses, number of Good/Bad Responses, and what the percentages of Good/Bad Responses out of Total:
(index="A" OR index="B") (host="A")
| stats count as Total, count(eval(tonumber(status)>=400)) as "Bad_Request" , count(eval(tonumber(status)<=399)) as "Good_Request"
| eval Bad_Request_Perc=((Bad_Request/Total)*100)
| eval Good_Request_Perc=((Good_Request/Total)*100)
However, when trying to exclude specific values to one range and adding values, I am able to retrieve "Bad_Requests" and respective percentage, but unable to retrieve any values for "Good_Requests" (and consequently percentage), using the following:
(index="A" OR index="B") (host="A")
| stats count as Total, count(eval(status>=400 AND status!=404 AND status!=410)) as "Bad_Request", count(eval(status<=399 AND status=404 AND status=410)) as "Good_Request"
| eval Good_Request_Percentage=((Good_Request/Total)*100) | eval Bad_Request_Percentage=((Bad_Request/Total)*100)
Does anyone know why I can get results excluding from a range, but can't get results specifying a range and specific values?
Thanks.
Logically, no status
is ever going to be <=399
AND =404
at the same time. Change that to OR
.
(index="A" OR index="B") (host="A")
| stats count as Total,
count(eval(status>=400 AND status!=404 AND status!=410)) as "Bad_Request",
count(eval(status<=399 OR status=404 OR status=410)) as "Good_Request"
| eval Good_Request_Percentage=((Good_Request/Total)*100) | eval Bad_Request_Percentage=((Bad_Request/Total)*100)
Logically, no status
is ever going to be <=399
AND =404
at the same time. Change that to OR
.
(index="A" OR index="B") (host="A")
| stats count as Total,
count(eval(status>=400 AND status!=404 AND status!=410)) as "Bad_Request",
count(eval(status<=399 OR status=404 OR status=410)) as "Good_Request"
| eval Good_Request_Percentage=((Good_Request/Total)*100) | eval Bad_Request_Percentage=((Bad_Request/Total)*100)