Hi all,
I have two searches that provide useful data points. One shows failures, one successes. I would like to further enhance this data by showing the failures as a percentage of total and successful transactions. I have looked a couple examples and haven't been able to formulate a working query. Below is what I think should work (based on this example) however I get an error: Error in 'search' command: Unable to parse the search: unbalanced parentheses. My parentheses are matching. I'd be grateful for a little help.
Thanks!
(index="x" source="foo" | transaction RequestId keepevicted=true | search success)
OR
(index="x" source="foo" | transaction RequestId keepevicted=true | search NOT success)
| eval(index="x" source="foo" |transaction RequestId keepevicted=true | search success) as success,
| eval(index="x" source="foo" |transaction RequestId keepevicted=true | search NOT success) as failure
| eval pct=100 * failure / success
Well, I don't think you can use parentheses across piped commands. Using the ever popular and rather simple example of authentication logs, which could look like;
SUCCESS: 2012-05-14 13:23:33 action=login status=success userid=bob
FAILURE: 2012-05-14 14:54:21 action=login status=failure userid=sally
The search would then be something like;
sourcetype=my_auth action=login
| stats c AS TOTAL c(eval(status="success")) AS OK c(eval(status="failure")) AS BAD
| eval BAD_PERC = round((BAD / TOTAL *100),2)
Hope this helps,
Kristian
Well, I don't think you can use parentheses across piped commands. Using the ever popular and rather simple example of authentication logs, which could look like;
SUCCESS: 2012-05-14 13:23:33 action=login status=success userid=bob
FAILURE: 2012-05-14 14:54:21 action=login status=failure userid=sally
The search would then be something like;
sourcetype=my_auth action=login
| stats c AS TOTAL c(eval(status="success")) AS OK c(eval(status="failure")) AS BAD
| eval BAD_PERC = round((BAD / TOTAL *100),2)
Hope this helps,
Kristian
Thanks! This helped a bunch. Much simpler too and I love simpler.