Dynamically adjust percentage based on time for 5 min intervals

[msrama5]

Hello, I have this query that needs dynamically adjusted for time duration, the results are written every 5 mins so , in 24 hrs period there will be 288 results written,  I am dividing by 288 in query below to calculate percentage rate.

earliest = -24h index=error_log  | eventstats count as fcount by "Properties.QueryName" |
eval percent = round((fcount/288)*100,2) | stats values(percent) as Failure_Percentage by "Properties.QueryName" 

If I change this query to pass start time and end time , the query needs to calculate duration and divide by 5 mins to get number of data counts and calculate the percentage rate, how can this query be modified to calculate time duration and find the right count to divide assuming data is expected every 5 mins.

[thambisetty]

earliest = -24h index=error_log 
| stats count as fcount by "Properties.QueryName" 
| addinfo 
| fields - info_sid,info_search_time 
| eval slices=((info_max_time-info_min_time)/60)/5
| eval percent = round((fcount/slices)*100,2) 
| stats values(percent) as Failure_Percentage by "Properties.QueryName" 

[Nisha18789]

Hi @msrama5 , could you please elaborate more on what you are trying to achieve in this query.

Also, can you check if this gives you the expected result?

earliest = -24h index=error_log  | top  "Properties.QueryName"