Table output with Stats command

[poddura]

Hi All,

I am trying to generate a output using stats command where I want to display table like below

Hostname    FTName       Total      Error Code    Error_Count     Error_rate%

ABC                 some_ft       1000       8945                300                       30.0

I used below query which is giving me output without Error Code, if I add Error_code in stats by command it is giving total count of that error code but I want total to be total request that Ft got and out of that 8945 error code got 300 errors. How to achieve this.

index=xyz sourcetype=app_team   log_message.FT=some_ft|rename log_message.CODE as FTCODE|stats count as Total_Requests ,count(eval(FTCODE=="8945")) as Errors by server_host, log_message.FT
| eval Error_rate=round(Errors/Total_Requests*100,2).+"%"|rename log_message.FT as FT

Hostname FT Total_Requests Errors Error_rate

ABC

some_ft

259

14

5.41

[gcusello]

Hi @poddura,

le me understand: do you want to execute your search only for one Error_Code (FTCODE)?

if yes, you can add a static eval at the end 

index=xyz sourcetype=app_team   log_message.FT=some_ft
|rename log_message.CODE as FTCODE
| stats count as Total_Requests ,count(eval(FTCODE=="8945")) as Errors by server_host, log_message.FT
| eval Error_rate=round(Errors/Total_Requests*100,2).+"%", FTCODE="8945"
| rename log_message.FT as FT

Yoiu can use the same method also if the error code is passed to the search by an input object.

Ciao.

Giuseppe