I have two queries. One gets the total number of events using the message field:
index=my_index sourcetype=my_sourcetype
| stats count(message) AS TotalA
| table TotalA
And the other uses multiple regex statements and the message field to get the total number of errors:
index=my_index sourcetype=my_sourcetype
| regex message = "(?:(^Problem.*)|((?i).*Issue.*)|((?i).*Error.*))"
| stats count(message) AS TotalB
| table TotalB
My goal is to have TotalA and TotalB side by side in a table. I would then like to divide TotalA by TotalB to get a ratio and display that alongside TotalA and TotalB in the table.
How could I go about combining these? Thanks!
This should work:
index=my_index sourcetype=my_sourcetype
| eval isProblem=if(match(message,"(?i)(?:problem)|(?:issue)|(?:error)"),1,0)
| stats count as totalMessage, sum(isProblem) as countErrors
| eval ratioErrors = round(countErrors/totalMessage,4)
This should work:
index=my_index sourcetype=my_sourcetype
| eval isProblem=if(match(message,"(?i)(?:problem)|(?:issue)|(?:error)"),1,0)
| stats count as totalMessage, sum(isProblem) as countErrors
| eval ratioErrors = round(countErrors/totalMessage,4)
Thank you so much!