First query:
index="raw_es2" app message="[Login][Password]Login simplified active."
| stats count by message
| rename count as "Calls"
| table Calls
Second Query:
index="raw_es2" app message="[Login][Password]Login simplified active."
| table flowId
| join type=inner flowId
[
search index"raw_es2" app message="[Login][Password] finished."
]
| stats count by message
| rename count as "Success"
| table Success
Third Query:
index="raw_es2" app message="[Login][Password]Login simplified active."
| table flowId
| join type=inner flowId
[
search index"raw_es2" app message="[Login][Password] finished with error."
]
| stats count by message
| rename count as "Errors"
| table Errors
Is that possible I put the result of each query in a eval to calculate the percentage of error and success?
Something like:
| stats sum(calls), sum(success), sum(errors)
| eval error percentage = round(success*100/Calls)
| eval success percentage = round(errors*100/Calls)
| eval "error percentage" > 0
The gold would be to have an answer like this all at once:
Calls: Success: Errors: PercentualErrors: PercentualSuccess:
299 285 14 4.68 95.32
Hi @francine0,
you coud try a different approach:
index="raw_es2" (message="[Login][Password]Login simplified active." OR message="[Login][Password]Login simplified active." OR message="[Login][Password]Login simplified active.")
| eval action=case(message="[Login][Password]Login simplified active.", "Start", message="[Login][Password]Login simplified active.", "Success", message="[Login][Password]Login simplified active.", "Error")
| stats
count(eval(action="Start")) AS Calls
count(eval(action="Success")) AS Success
count(eval(action="Error")) AS Error
| eval
PercentualErrors=round(Error/Calls*100,2),
PercentualSuccess=round(Success/Calls*100,2)
| table Calls Success Error PercentualErrors PercentualSuccess
Ciao.
Giuseppe