I ran a search to get total request count, success count, and error count by Application ID, and then calculated success percentage as well and get the application ID, request count, success count, error count, and success percentages in table format in a dashboard. I want to get the Success percentage for consecutive time intervals as mentioned below :
1st success percent column should have -10m@m data
2nd success percent column should have -20m@m to -10m@m data
3rd success percent column should have -30m@m to -20m@m data
and want to show in dashboard like below:
Application ID RequestCount SuccessCount ErrorCount -10mSuccessPercent -20m to-10m SuccessPercent -30m to -20m SuccessPercent
How to get this consecutive success count, please help asap.
Tried timewrap, but not getting required result. Please find the complete search I am using below for getting consecutive time Success Percentage.
index=xxx sourcetype=abcd earliest=-20m latest=now | stats count(eval(STATUSCODE="ERROR" OR STATUSCODE="COMPLETE" OR STATUSCODE="COMPLETED")) as "RequestCount", count(eval(STATUSCODE="COMPLETE" or STATUSCODE ="COMPLETED")) as "SuccessCount", count(eval(STATUSCODE="ERROR")) as "ErrorCount" by ID COMPONENT | eval Result=round(((SuccessCount)/RequestCount)*100,2)." %" | appendcols [ search index=xxx sourcetype=abcd earliest=-10m latest=now | stats count(eval(STATUSCODE="ERROR" OR STATUSCODE="COMPLETE" OR STATUSCODE="COMPLETED")) as "RequestCountlatest", count(eval(STATUSCODE="COMPLETE" or STATUSCODE="COMPLETED")) as "SuccessCountlatest", count(eval(STATUSCODE="ERROR")) as "ErrorCountlatest" by ID COMPONENT ] | eval LatestResult=round(((SuccessCountlatest)/RequestCountlatest)*100,2)." %" | table ID COMPONENT SuccessCount ErrorCount RequestCount SuccessCountlatest ErrorCountlatest RequestCountlatest Result LatestResult | fillnull value=0
As you see, the main search runs between -20 to now time duration and subsearch runs between -10 to now time duration.
Surprisingly, I am getting some data in subsearch columns which I am not getting in main search columns.
I want Result and latestResult column data in respect to ID and COMPONENT for the respective duration.
If ID has A value and COMPONENT has B value in subsearch timeframe and showing percentage result in LatestResult column, then I should get the same or more value in main search timeframe as subsearch time frame falls under main search timeframe.
Basically, I need consecutive 10min time SuccessPercentage with respect to ID and Component. Please help to get the required result.