How can I get the percentage of requests taking less then 500ms?

[kdulhan]

I have a below query:

index=idx1 | search 'apiname' = AccountSec | eval TotalTime=Start-End | stats count as "TotalRequests",count(eval(StatusCode like "2%")) as "SuccessCount",count(eval(StatusCode = "500")) as "Error 500",count(eval(StatusCode > "200")) as "Total errors" ,count(eval(TotalTime>500)) as "Count1"by apiname

Kindly let me know how can I get the percentage of requests taking less then 500ms i.e. ((TotalRequests-Count1)/TotalRequests)*100.

[renjujacob88]

Hi
Try this one out
index=idx1 | search 'apiname' = AccountSec | eval TotalTime=Start-End | stats count as "TotalRequests",count(eval(StatusCode like "2%")) as "SuccessCount",count(eval(StatusCode = "500")) as "Error 500",count(eval(StatusCode > "200")) as "Total errors" ,count(eval(TotalTime>500)) as "Count1"by apiname |Eval Total= TotalRequests-Count1 |eval percentage=((Total/TotalRequests)*100) | eval "rounded_percent"=round('percentage')