Calculating % error rate from a single field for a timechart

[dreeck]

Hey All,

I'm trying to make a timechart that shows the % of un-successful requests processed every hour. Success (or not) is represented in the 'info' field as 4 separate values: granted, canceled, failed, and completed. I'd like to group 'failed/canceled' into a single value called 'errors', and then divide errors by total requests to get a error rate percentage.

| eval status=if(IN(info,"canceled","failed"), "failed","success")

| timechart count(status) by status

The snippet above let's me generate a 'stacked 100%' chart that comes close, but I really am looking for a line chart that shows only error rate percentage. If feels like I'm missing something ultra basic, but I haven't found an answer yet. Seems like it should be close to

| stats = count as total
| eval status=if(IN(info,"canceled","failed"), "1","0")

| eval error_rate = count(status)/total

Tips appreciated!

Dave

[renjith_nair · Accepted solution]

@dreeck,

Try

|timechart span=1h count as total,count(eval(status=="canceled" OR status=="failed")) as error
| eval error_rate=error/total
| fields - total,count

Adjust the fields/calcs according to your final requirements.

[dreeck]

Thank you Renjith! This gets me very close. What I'd like to do is show only the error rate. This shows the total, error and error rate lines. Got a tip on how to calculate error rate without showing total & count?

[renjith_nair]

@dreeck, yep just remove the fields using

|fields - total,count

Updated the answer