How to get stats by hour and calculate percentage for each hour?

[bijodev1]

Hi There,

I am trying to get the an hourly stats for each status code and get the percentage for each hour per status. Not sure how to get it.

my search | 
| bucket _time span=1h
| stats count by _time http_status_code
| eventstats sum(count) as totalCount | eval percentage=round((count/totalCount),3)*100

please suggest which command could be helpful here. 

thanks

[bijodev1]

@somesoni2 thank you for the help, it worked.

[somesoni2 · Accepted solution]

Give this a try

my_search
| bucket _time span=1h
| stats count BY _time http_status_code
| eventstats sum(count) as totalCount by _time
| eval percentage=round((count/totalCount),3)*100
| table _time http_status_code count percentage

[gcusello]

Hi @bijodev1,

please try this:

my_search
| eventstats sum(count) as totalCount 
| bucket _time span=1h
| stats values(totalCount) AS totalCount count BY _time http_status_code
| eval percentage=round((count/totalCount),3)*100

Ciao.

Giuseppe

[bijodev1]

what I am basically looking for here is 

_time                                 status                           count                                percentage

12:30.                                 100                                 400.                                        30

12:30                                  200                                 600                                         60

12:30                                  300                                 400                                         30

01:30                                  100                                  100                                         10

01:30                                  200                                  400                                          45

01:30                                  300                                  400                                          45

like wise

[gcusello]

Hi @bijodev1,

please try this:

my_search
| eventstats count as totalCount 
| bucket _time span=1h
| stats values(totalCount) AS totalCount count BY _time http_status_code
| eval percentage=round((count/totalCount),3)*100

Ciao.

Giuseppe

[bijodev1]

Hi @gcusello 

thank you for the response, but didn't got me any output. 

It doesn't show the percentage and total count per hour