Hi Team
I have a query where I am doing the TimeChart & % (not using the timechart and calculate the % in timechart line as this doesn't solve my purpose hence using it this say)
The query is working fine however it shows all the data on field and I want to have that field only show top 10 by volume or count
Query
index=xyz (catcode="*") (prodid="1") (prodcat="*") success="*"
| bucket _time span="1d"
| eval TheError=if(success="false" AND Error_Value like "%%",count,0)
| eval Success=if(success="true",count,0)
| stats sum(TheError) as "Failed", sum(Success) as "Passed", sum(count) as Total by _time, catcode
| eval Failed_Percent=round((Failed/Total)*100,2)
| fields _time, catcode, Failed_Percent
| xyseries _time, catcode, Failed_Percent
I don't want to do the 'eventstats' because it will count all on prodid level and not at catcode level hence this query
This query counts all false with error on catcode....and count all attempts on individual catcode, then calculate the %
with event stats the total count will be not at catcode but all prodid count i.e. all catcode's total attempt's count
Thanks in advance
To show only the 10 results with the highest values of Failed_Percent you can use the sort command.
...
| xyseries _time, catcode, Failed_Percent
| sort 10 - Failed_Percent
At this point in your search:
index=xyz (catcode="*") (prodid="1") (prodcat="*") success="*"
| bucket _time span="1d"
| eval TheError=if(success="false" AND Error_Value like "%%",count,0)
| eval Success=if(success="true",count,0)
| stats sum(TheError) as "Failed", sum(Success) as "Passed", sum(count) as Total by _time, catcode
you have 5 fields, _time, catcode, Failed, Passed and Total.
Where does prodId come from?
If you use eventstats at this point, you can sum the Total to find count all the events by catcode.
index=xyz (catcode="*") (prodid="1") (prodcat="*") success="*"
| bucket _time span="1d"
| eval TheError=if(success="false" AND Error_Value like "%%",count,0)
| eval Success=if(success="true",count,0)
| stats sum(TheError) as "Failed", sum(Success) as "Passed", sum(count) as Total by _time, catcode
| eventstats sum(Total) as Total_catcode by catcode
Does that help you? If not, please explain with some examples of what you are currently have and what you would like to see
To show only the 10 results with the highest values of Failed_Percent you can use the sort command.
...
| xyseries _time, catcode, Failed_Percent
| sort 10 - Failed_Percent
This only sorts the time and instead of 10 showing single column of catcode...the one is hihest