Hi All,
I need helping writing a search.
If HTTP status for error codes is more than 5% of the overall request (exclude 401error code)
Please help. Thanks.
Like this:
... | timechart span=1h count as total count(eval(tonumber(http_status)>=400)) AS statusCount400andUp count(eval(tonumber(http_status)=401)) AS statusCount401 | eval pctMyBad = 100*(statusCount400andUp - statusCount401)/total | where pctMyBad > 5
Like this:
... | timechart span=1h count as total count(eval(tonumber(http_status)>=400)) AS statusCount400andUp count(eval(tonumber(http_status)=401)) AS statusCount401 | eval pctMyBad = 100*(statusCount400andUp - statusCount401)/total | where pctMyBad > 5
thanks a lot:-)
Does the following link help? link text
Dave
Thanks:-).