How to edit my stats search to calculate a percentage based on a custom range?

[justx001]

I have a search from web logs that I need to calculate a percentage based on a custom range.

Search example:

index=xxxxx env=prod | search message="1" as one, search message="2" as two, search message="3" as three, search message="4" as four | eventstats p90(timeTaken) as nTT | eval nTT < (TimeTaken * 0.9) | stats max(TimeTake), count(TimeTaken), avg(nTT) by group

This works for one value, but when I create a table with multiple rows, I get the same avg value for all rows which is wrong. Is there an easier way to calculate the percent value based on a custom data set?

[sundareshr · Accepted solution]

Looks like you are missing a group-by in your eventstats. Try this query

 index=xxxxx env=prod | search message="1" as one, search message="2" as two, search message="3" as three, search message="4" as four | eventstats p90(timeTaken) as nTT by group | where nTT < (TimeTaken * 0.9) | stats max(TimeTake), count(TimeTaken), values(nTT) by group

[justx001]

i copy and pasted too many "search" statements, that is not how my query is but thought I should repost to clarify

 index=xxxxx env=prod | spath message | search message="1" as one, message="2" as two, message="3" as three, message="4" as four | eventstats p90(timeTaken) as nTT | eval nTT < (TimeTaken * 0.9) | stats max(TimeTake), count(TimeTaken), avg(nTT) by group 

[somesoni2]

Are you sure this search works?? I don't think the | search and | eval works like this.