How to group status code in coloumn

[chiddarthan17]

I need to display list of all failed status code in column by consumers

Final Result:

Consumers	Errors	Total_Requests	Error_Percentage	list_of_Status
Test	10	100	10	500 400 404

Is there a way we can display the failed status codes as well in of list of status coloumn

index=test | stats count(eval(status>399)) as Errors,count as Total_Requests by consumers | eval Error_Percentage=((Errors/Total_Requests)*100)

[chiddarthan17]

Thanks a lot. This works fine. Is there a way we can display only status which are greater than 399. Like (status>399)

i tried values(eval(status>399)) but it didn't work. 

[richgalloway]

Try this query

index=test | stats count(eval(status>399)) as Errors,count as Total_Requests, values(Status) as list_of_Status by consumers 
| eval Error_Percentage=((Errors/Total_Requests)*100)

[chiddarthan17]

Thanks a lot. This works fine. Is there a way we can display only status which are greater than 399. Like (status>399)

i tried values(eval(status>399)) but it didn't work. 

[bowesmana · Accepted solution]

You need the eval like this

values(eval(if(status>399, status, null()))) as list_of_Status 

otherwise the eval just returns a boolean type result, so you need to use if and assign the result.

You can also do it like this after the stats using mvmap

| eval list_of_Status=mvfilter(list_of_Status>=399)

[chiddarthan17]

Thank you.This works perfectly.