Eval Ranges combined with specific values

[bfong]

Hi,

I'm looking to grab numbers of http responses (status) as "Good" or "Bad" and am successful with the following query in which I can get Total number of Responses, number of Good/Bad Responses, and what the percentages of Good/Bad Responses out of Total:

    (index="A" OR index="B") (host="A")
   | stats count as Total, count(eval(tonumber(status)>=400)) as "Bad_Request" , count(eval(tonumber(status)<=399)) as "Good_Request" 
   | eval Bad_Request_Perc=((Bad_Request/Total)*100) 
   | eval Good_Request_Perc=((Good_Request/Total)*100)

However, when trying to exclude specific values to one range and adding values, I am able to retrieve "Bad_Requests" and respective percentage, but unable to retrieve any values for "Good_Requests" (and consequently percentage), using the following:

 (index="A" OR index="B") (host="A")
| stats count as Total, count(eval(status>=400 AND status!=404 AND status!=410)) as "Bad_Request", count(eval(status<=399 AND status=404 AND status=410)) as "Good_Request"
| eval Good_Request_Percentage=((Good_Request/Total)*100) | eval Bad_Request_Percentage=((Bad_Request/Total)*100)

Does anyone know why I can get results excluding from a range, but can't get results specifying a range and specific values?

Thanks.

[DalJeanis · Accepted solution]

Logically, no status is ever going to be <=399 AND =404 at the same time. Change that to OR.

 (index="A" OR index="B") (host="A")
 | stats count as Total, 
count(eval(status>=400 AND status!=404 AND status!=410)) as "Bad_Request", 
count(eval(status<=399 OR status=404 OR status=410)) as "Good_Request"
 | eval Good_Request_Percentage=((Good_Request/Total)*100) | eval Bad_Request_Percentage=((Bad_Request/Total)*100)