How do I use the eval command to calculate error rates and show them as percentages?

[moizmmz]

Hello,

I am creating a dashboard in which I am displaying total logins, successful logins, failed logins, error rates for each failed login, and percentages of failed logins.

Where:

Total Logins say count is 1000
Successful logins where status=200 say count=800
Failed logins is when status!=200 say count = 200

i.e., when status=401(say count = 100) or 204 (say count = 50) or 404 (say count = 50)

I first need to calculate the error rate for each failed login. So say error rate for status =401. I know the math i.e., 50/1000 where 50 is count for 401 and 100 is the total logins. But, I don't know how to use the eval command very well. Pls help!!

Also, I need to calculate the percentage of failed logins i.e., (200/1000)*100. Again, need help with the eval command. Pls help!!

[CryoHydra]

Check if this helps.

your search
| stats count(eval(status="200")) as success count(eval(status!=200) as failed count(eval(status) as total_logon

| eval success_rate =(success/total_logon)*100 , failure_rate=(failed/total_logon)*100

[moizmmz]

Nope it gives an error 😞

[CryoHydra]

now try, if it is successful accept the answer.

My previous search was intended for each failed connection from a client, now i changed for over all summary.

[kmaron · Accepted solution]

index=akamai cp=654130 login 
| eventstats count (status) as Total 
| where status!=200 
| stats count(status) as Error, values(Total) as Total by status 
| eval error_rate= Error/Total 
| fields error_rate status

[moizmmz]

I just ran this and it worked perfectly!!'

Marry me 😛

[kmaron]

great!! I'll convert this to an answer then you can accept it.

[kmaron]

eval Error_Rate = (error_count/login_count)*100
eval Percent_Failed = (failed_count/login_count)*100

[moizmmz]

Its not working. Problem is that I cant use count in eval.

For example: Here Total_logins is count(status)

so I wrote: eval Total_logins=count(status), but it returns an error. Pls help!

[Vijeta]

Try this

yourquery| streamstats count(status) as Total|stats count(eval(Status!=200)) as Error by Status| eval Error_Rate = (Error/Total)*100

[moizmmz]

This doesn't work 😞 Help pls!

[Vijeta]

Try this

 index=akamai cp=654130 login| eventstats count (status) as Total|where status!=200| stats count(status) as Error, values(Total) as Total by status| eval error_rate= Error/Total

[moizmmz]

Well... the result displays the status, total_logins and number of errors. However, I want to display only the error rate and the status

[Vijeta]

You can add |fields error_rate status at the end of query

[moizmmz]

But there's no value for error_rate. It doesn't seem to be calculating it. I'm sorry for all the trouble 😞

[kmaron]

Try this:

index=akamai cp=654130 login 
| eval error_ind = if(status=200,0,1) 
| stats count(status) as Total, sum(error_ind) as Errors by status 
| eval error_rate= (Errors/Total)*100
| fields error_rate status

[kmaron]

@moizmmz did this help you at all?

[Vijeta]

@moizmmz what does your event look like and what are field names for status? Each event means a login?

[moizmmz]

Here's my query:

index=akamai cp=654130 login| stats count (status)

This basically gives me the total logins.

Next, status=200 gives me successful logins and status!=200 gives me failed logins.

[kmaron]

You need to use stats in order to get your counts. I assumed you already had those counts.

[moizmmz]

hmm.. I still dont understand how to get them. pls help!!

For example: how would I get total_logins?