Considering a set of servers, I would like to plot the percentage of errors for each server over time. I am trying to create one view with a line for each server.
I managed to get a statistics table with the following query and tried to pipe something like "xyseries _time, host, percent", but this doesnt work.
... | chart count(eval(responseCode like "2%")) AS success, count(eval(NOT responseCode like "2%")) AS failure by host | addtotals fieldname=Total success, failure | eval Errors_Percentage=round(failure*100/Total)
I tried with a timechart as well, but then didn't manage to add the percentage field for each span/host.
This, I think, should give you the chart you're looking for
... | eval httpstatus=if(status>299, "Failed", "Success") | bin _time as t span=1d | eval time_host=t."@".host | chart count over time_host by httpstatus | addtotals | eval Perc=Failed/Total*100 | rex field=time_host "(?<Time>\d+)@(?<Host>\w+)" | table Time Host Perc | fieldformat Time=strftime(Time, "%Y/%m/%d") | xyseries Time Host Perc