I am calculating percentage for each https status code. But i also would like to display the total number of requests in results. Below query displays only percentage of each status code. Is there a way i can add _Total in results?
Query:
index=app_ops_prod host="sl55caehepc20*" OR host="sl55sdsapp001" OR host="sl55sdsapp002" source="/var/mware/logs/SDS*/*localhost*" method="POST" | timechart span=1d count by status|addtotals row=true fieldname=_Total|foreach * [eval <<FIELD>> = '<<FIELD>>' * 100 / _Total]
_Total is in the results, it is just hidden because it begins with an underscore. Try adding the following line
| rename _Total as Total
_Total is in the results, it is just hidden because it begins with an underscore. Try adding the following line
| rename _Total as Total
Worked like a charm! Thanks @ITWhisperer 🙂