How to get peakstats and a count of success and errors for a month in one table?

[ashidhingra]

How to get peakstats and a count of success and errors for a month in one table?

[gcusello]

Hi @ashidhingra,

the search depends on the data you have.

So supponing that the field with the traffic to monitor i "bytes" and the field with access and failed is "action" and that you want thes monitoring for each host, you could try something like this, for a month:

<your_search>
| stats
   max(bytes) AS peak
   count(eval(action="success")) AS success
   count(eval(action="failed")) AS failed
   BY host

 Ciao.

Giuseppe

[ashidhingra]

I am getting the peak stats by bucket using this 

<your_search>
| bucket span=1s _time 
| stats count by _time 
| timechart max(count) AS Peak_TPS span=1m

Some how the two Queries are not working together 

[gcusello]

Hi @ashidhingra,

yes, because after a stats command you have only the fields in the stats, you shuld try something like this:

<your_search> earliest=-1mon latest=@mon
| bucket span=1s _time 
| stats 
   count 
   count(eval(action="success")) AS success
   count(eval(action="failed")) AS failed
   BY _time 
| stats
   max(count) AS Peak_TPS 
   sum(success) AS success
   sum(failed) AS failed

You cannot use timechart because in timechart you cannot have more fields

Ciao.

Giuseppe