I would like to get stats by http status and also i would like to add percentage column. when i use top it gives by uri or some other field which i don't want.
Right now output looks like this. But i need to add percentage.
Try something like this
your base search | stats count by status | eventstats sum(count) as perc | eval perc=round(count*100/perc,2)
View solution in original post