Hi,
I would like to get stats by http status and also i would like to add percentage column. when i use top it gives by uri or some other field which i don't want.
Right now output looks like this. But i need to add percentage.
status count
200 557374
301 151
302 61
400 33
404 542
405 24
500 6541
Try something like this
your base search | stats count by status | eventstats sum(count) as perc | eval perc=round(count*100/perc,2)
Try something like this
your base search | stats count by status | eventstats sum(count) as perc | eval perc=round(count*100/perc,2)