I would like to show http traffic from my f5 (load balancer) to web servers for statuses 200 and 404 (200 green, 404 red). As a basic example something like this:
index = iis
| stats sum(eval(status="404")) as error sum(eval(status="200")) as success by dest_ip
|eval from="f5" , to=dest_ip
|head 100
|table from to success error
I can't seem to get the flows working. I have changed names to match error, warn, good but have not had much success.
any pointers would be appreciated.
please feel free to expand on this query to add more value. My aim is to visualize traffic flows to show when there are issues etc
Hi @nathanluke86
Thanks for using my Viz. This query should work:
index = iis
| stats count(eval(status="404")) as error count(eval(status="200")) as good by dest_ip
|eval from="f5" , to=dest_ip
|head 100
|table from to good error
Hi @nathanluke86
Thanks for using my Viz. This query should work:
index = iis
| stats count(eval(status="404")) as error count(eval(status="200")) as good by dest_ip
|eval from="f5" , to=dest_ip
|head 100
|table from to good error
Thanks, this worked perfectly
Hi,
I'd like to show near real time web traffic without refresh dashboard,
any pointers would be appreciated.
Is there also a way to display Success instead of good
at the end of your query, add this:
| eval label = "Success: " + good + " Error: " + error