I want to craft an alert that will get the number of errors:
sourcetype="my-thing" error | stats count
and the number of not errors:
sourcetype="my-thing" NOT error | stats count
then get the percentage of the first over the second
I think I got it:
sourcetype="my-thing" | eval err = if(searchmatch("error"), 1, 0) | eval notErr = if(searchmatch("NOT error"), 1, 0) | stats sum(err) as errNo sum(notErr) as notErrNo | eval errorPercentage = errNo/notErrNo*100
I think I got it:
sourcetype="my-thing" | eval err = if(searchmatch("error"), 1, 0) | eval notErr = if(searchmatch("NOT error"), 1, 0) | stats sum(err) as errNo sum(notErr) as notErrNo | eval errorPercentage = errNo/notErrNo*100
Good call, Reed!
Looking good. I would have thought you want errNo/count*100. If you have only errors, you will get divide by zero error instead of 100%.