OK - I can't get this simple chart to work. Just need to graph Percent Fails by host over time
this is my start right now
index=app sourcetype=app_source source=*source.log "failedfor" OR "worked"
| bucket span=30m _time
| eval bad=if(searchmatch("failedfor"),1,0)
| stats count as total sum(bad) as bad by host
| eval conversion=(bad/total)*100
I can get like variations of the correct stats, but not charted by time and host (% over 30m plot points)..
thank you!
shawn
You almost had it. In order to chart
across time ( timechart
), you need the _time
field.
Your stats
command does not include the _time
field, so the field stopped existing after that command.
Change to ...
| stats count as total sum(bad) as bad by host _time