Try this (not sure if need to use percentile, just percentage should do it)
Updated
index=xxx*
|stats count(Proxy) as "totcnt" count(eval(Status="404")) as "failurecnt" by Name
|eval failurepercent=failurecnt*100/totcnt | where failurepercent>90
Unless I'm missing something, count(eval(Proxy))
could be more simply written count(Proxy)
, which will give the count of values in the Proxy
field.
You're correct. Didn't look for that before. Corrected.