Creating buckets based a percentage of occurrence.

[zacksoft]

BASE_SEARCH | stats count(web-calls) as web-call-count by server_response | eventstats sum(web-call-count) as total | eval percentage=round((web-call-count*100/total),2) | table server_response percentage

As a result of the above query following is the output I get in the statistics tab and a column chart in visualization tab.

server_respond percentage_of_web-calls
0.001 7.77
0.002 17.95
0.003 13.90
0.004 7.16
0.005 3.30
0.006 2.53
0.007 2.11
0.008

Can we create three columns in the visualization tab where
column 1 showing the percentage of web-calls whose response were less than a second.
column 2 showing percentage of web-calls ...whose response time between 1 to 10 sec.
column 3 showing ..more than 10 sec..

[kamlesh_vaghela · Accepted solution]

@zacksoft

Can you please try this?

BASE_SEARCH 
| eval bucket = case(server_respond<1,"Bucket 1", (server_respond > 1 AND server_respond < 10),"Bucket 2", 1=1,"Bucket 3")
| stats count(web-calls) as web-call-count by bucket 
| eventstats sum(web-call-count) as total 
| eval percentage=round((web-call-count*100/total),2) 
| table bucket percentage

[zacksoft]

Thank you . It works.

[kamlesh_vaghela]

@zacksoft

Great!! Can you please upvote and accept the answer to close this question?