I'm trying to get a weighted ratio of errors per server. I have a lookup table like this:
host,percent
server1,25
server2,25
server3,50
Normally I'd do something like sourcetype=iis sc_status=500 [| inputlookup ratio | fields host] | chart count by host
, which gives me a count of errors by server, but I want a weighted count based on that percent.
How would I use the lookup table to multiply the errors on a per server basis?
Hi! 🙂
So, if what you want to do it multiply the count by the defined percent value for each of these hosts, you could do something like:
sourcetype=iis sc_status=500 [| inputlookup ratio | fields host] | lookup yourlookuptable host OUTPUT percent | chart count by host | eval weightedcount=count*percent/100
Hi! 🙂
So, if what you want to do it multiply the count by the defined percent value for each of these hosts, you could do something like:
sourcetype=iis sc_status=500 [| inputlookup ratio | fields host] | lookup yourlookuptable host OUTPUT percent | chart count by host | eval weightedcount=count*percent/100