Hi All,
Good Day!
I have 2 indexes and having different source types and diff uri,
index 1--- nere having httpstatuscodes
1. one uri having only 200,403,422 are success remaining failure
2.remaing uri's 200 is success and remaining failure
index 2--
diffrent-- uri --
one uri having 200 is success ---here having Respnsecodes
how to get success percentage by using timechart by country
please help on this
thanks..will try
Hi ,
I am having data like below
1.httpstatuscode
2.responsecode
3.CountryCode
4.countrycode
need to show success perc by country
index=index1 OR index=index2
| eval success=case(index=="index1" AND url=="special url" AND httpstatuscode IN ("200","403","422"), "success", index="index1" AND httpstatuscode == "200", "success", index=="index2" AND responsecode=="200", "success", 1==1, "failure")
| eval country=coalesce(CountryCode, countrycode)
| bin _time span=1d
| stats count by _time country success
| eventstats sum(count) as total by _time country
| eval percent=if(success="success", 100 * count / total, null())
| timechart values(percent) by country
Try something like this
index=index1 OR index=index2
| eval success=case(index=="index1" AND url=="special url" AND httpstatuscode IN ("200","403","422"), "success", index="index1" AND httpstatuscode == "200", "success", index=="index2" AND Responsecode=="200", "success", 1==1, "failure")
| bin _time span=1d
| stats count by _time country success
| eventstats sum(count) as total by _time country
| eval percent=if(success="success", 100 * count / total, null())
| timechart values(percent) by country