How do I search if HTTP status for error codes is more than 5% of the overall request, but exclude error code 401?

[marees123]

Hi All,

I need helping writing a search.

If HTTP status for error codes is more than 5% of the overall request (exclude 401error code)

Please help. Thanks.

[woodcock · Accepted solution]

Like this:

... | timechart span=1h count as total count(eval(tonumber(http_status)>=400)) AS statusCount400andUp count(eval(tonumber(http_status)=401)) AS statusCount401 | eval pctMyBad = 100*(statusCount400andUp - statusCount401)/total | where pctMyBad > 5

[marees123]

thanks a lot:-)

[davebrooking]

Does the following link help? link text

Dave

[marees123]

Thanks:-).