How to chart URLS by error code percentage

[mgpspr]

We are grabbing logs from nginx. I would like to know how I can chart URLS that are returning a 408 error code as well as a percentage from the overall status codes. Here is an example of what I am trying to do:

Build a chart that shows all the PUTs and POSTs requests followed by the URL, then show the percentage of the error code out of all percentage codes in the log.

"PUT /borrower/api/v1/prospect/update HTTP/1.1" 408 0
"POST /borrower/api/v1/registration HTTP/1.1" 408 51

[jtrucks · Accepted solution]

First, check the nginx log parsing post on Answers for parsing your logs.

Then if you name your fields "path" and "code" you simply do something like:

... | top code limit=0 | table code, percentage | where code=408

To give you a breakdown of the percentage of codes without the default 10 items to list all options in case there are more than 10 and your 408 code is low on the list, then pull out the code and percentage only as a table, limited to only entries with the 408 code.

There are a number of other ways to slice this up, as well, but this ought to get you want you need.

[mikelanghorst]

Though if you're only concerned with status=408, I'd go ahead and put it in the originating search, before the "|top" shown here.

[jtrucks]

mikelanghorst, that prevents you from getting the % 408 codes of the whole.

[Fergal111]

Is there a solution here? This will not get percentage of 408 errors over total requests.
Thanks,

[aljohnson_splun]

@fergal111 do something like

... | top url by status

^ there are any number of similar solutions