I have a query that ends with:
| eval error_message=mvindex(splited,0) | stats count as error_count by error_message | sort error_count desc | eval error_rate=round(error_count/(TOTAL_ERRORS)*100,0)
Which produces a table with 3 columns: | error_message | error_count | error_rate |
error_count represents the number of error_message occurrences for each error_message .
I'm trying to create a variable named TOTAL_ERRORS that would represent the total sum of all error_count values (the total number of all error_message occurrences of any type). I need the TOTAL_ERRORS variable in order to calculate the error_rate for each error_message.
I need help in creating this TOTAL_ERRORS variable.
I tried to do that with
which resulted in a table with a single row of the grand total.
I don't want TOTAL_ERRORS to have any effect on the table. I need it only for calculations.