I would like to get the percentage of each HTTP status code. I have the count of each status code that appears and I just need a way to divide each code by the total number so I can get the percentage.
Assuming you have a table reflecting a column of http codes along with a column of count (as "count"), try the following adding the following to your search query;
| eventstats sum(count) as total
| eval code_per = round((count / total)*100,2)."%"
| fields - total
Assuming you have a table reflecting a column of http codes along with a column of count (as "count"), try the following adding the following to your search query;
| eventstats sum(count) as total
| eval code_per = round((count / total)*100,2)."%"
| fields - total
That didn't completely work for me, but I did use the sum(count) as total which gave me what I was looking for. Thanks!
Copy.
If you want to provide more information we can attempt to work further into making sure it works correctly otherwise I'm glad you were able to make it work and if satisfied, please mark answered 🙂
Have a good day!