How to chart the percentage of errors per server over time?

[fc_splk]

Hi,

Considering a set of servers, I would like to plot the percentage of errors for each server over time. I am trying to create one view with a line for each server.

I managed to get a statistics table with the following query and tried to pipe something like "xyseries _time, host, percent", but this doesnt work.

 ... |  chart count(eval(responseCode like "2%")) AS success, count(eval(NOT responseCode like "2%"))  AS failure by host | addtotals fieldname=Total success, failure | eval Errors_Percentage=round(failure*100/Total)

I tried with a timechart as well, but then didn't manage to add the percentage field for each span/host.

Thanks!

[sundareshr · Accepted solution]

This, I think, should give you the chart you're looking for

... | eval httpstatus=if(status>299, "Failed", "Success") | bin _time as t span=1d | eval time_host=t."@".host | chart count over time_host by httpstatus | addtotals | eval Perc=Failed/Total*100 | rex field=time_host "(?<Time>\d+)@(?<Host>\w+)" | table Time Host Perc | fieldformat Time=strftime(Time, "%Y/%m/%d") | xyseries Time Host Perc