Hi all,
I have two searches that provide useful data points. One shows failures, one successes. I would like to further enhance this data by showing the failures as a percentage of total and successful transactions. I have looked a couple examples and haven't been able to formulate a working query. Below is what I think should work (based on this example) however I get an error: Error in 'search' command: Unable to parse the search: unbalanced parentheses. My parentheses are matching. I'd be grateful for a little help.
Thanks!
(index="x" source="foo" | transaction RequestId keepevicted=true | search success)
OR
(index="x" source="foo" | transaction RequestId keepevicted=true | search NOT success)
| eval(index="x" source="foo" |transaction RequestId keepevicted=true | search success) as success,
| eval(index="x" source="foo" |transaction RequestId keepevicted=true | search NOT success) as failure
| eval pct=100 * failure / success
... View more