How to get success percentage by using timechart by country?

[lucky]

Hi All,

Good Day!

I have 2 indexes and having different source types  and diff uri,

index 1--- nere having httpstatuscodes 
 1.  one uri having only 200,403,422 are success remaining failure

2.remaing uri's 200 is success and remaining failure 

index 2--

diffrent-- uri --

one uri having 200 is success ---here having Respnsecodes  

how to get success percentage by using timechart  by country

please help on this 

[lucky]

thanks..will try 

[lucky]

Hi ,

I am having data like  below 

1.httpstatuscode 

2.responsecode 

3.CountryCode 

4.countrycode 

need to show success perc by country 

[ITWhisperer]

index=index1 OR index=index2
| eval success=case(index=="index1" AND url=="special url" AND httpstatuscode IN ("200","403","422"), "success", index="index1" AND httpstatuscode == "200", "success", index=="index2" AND responsecode=="200", "success", 1==1, "failure")
| eval country=coalesce(CountryCode, countrycode)
| bin _time span=1d
| stats count by _time country success
| eventstats sum(count) as total by _time country
| eval percent=if(success="success", 100 * count / total, null())
| timechart values(percent) by country

[ITWhisperer]

Try something like this

index=index1 OR index=index2
| eval success=case(index=="index1" AND url=="special url" AND httpstatuscode IN ("200","403","422"), "success", index="index1" AND httpstatuscode == "200", "success", index=="index2" AND Responsecode=="200", "success", 1==1, "failure")
| bin _time span=1d
| stats count by _time country success
| eventstats sum(count) as total by _time country
| eval percent=if(success="success", 100 * count / total, null())
| timechart values(percent) by country