I have a query that ends with:
| eval error_message=mvindex(splited,0) | stats count as error_count by error_message | sort error_count desc | eval error_rate=round(error_count/(TOTAL_ERRORS)*100,0)
Which produces a table with 3 columns: | error_message | error_count | error_rate |
error_count represents the number of error_message occurrences for each error_message .
I'm trying to create a variable named TOTAL_ERRORS that would represent the total sum of all error_count values (the total number of all error_message occurrences of any type). I need the TOTAL_ERRORS variable in order to calculate the error_rate for each error_message.
I need help in creating this TOTAL_ERRORS variable.
I tried to do that with
stats sum(error_count)
which resulted in a table with a single row of the grand total.
I don't want TOTAL_ERRORS to have any effect on the table. I need it only for calculations.
Thank you,
Samuel
Hi
add to your search
| eventstats stats sum(error_count) AS Total
and use it for your calculation.
Bye.
Giuseppe
Hi
add to your search
| eventstats stats sum(error_count) AS Total
and use it for your calculation.
Bye.
Giuseppe
Thank you for your answer, but I'm getting the following error message:
Error in 'eventstats' command. The argument 'stats' is invalid
yeah, delete the word stats.
Sorry!
| eventstats sum(error_count) AS Total
Bye.
Giuseppe
Thanks guys, it worked, but I got an extra unnecessary "Total" column in my table.
Ho do I get the Total without affecting the table.
Add
| fields - Total
after the calculation.
If this answer solves your need, please accept it.
Bye.
Giuseppe