I have a timechart that shows the timechart of errors in a timeframe.
index=......| eval error=if(apiHttpStatus!=200, apiErrorCode, "Success")
| bin span=1m _time
| stats count by _time, error
| eventstats sum(count) as total by _time
| eval perc=round((count*100)/total,2)
| timechart span=1m values(perc) by error
This correctly displays the timechart of the error in the given timeframe. However, I want to remove successes from the final view, but not from the count. If an error occurs 1% of the time, I don't want to see in the view that 99% of events are successes, but I can't filter out successes from the initial search. I've done this by adding
| timechart span=1m values(perc) by error
| fields - Success
After the timechart. However, this leads to the odd situation where if I have had no errors in the time window, the result is a table of time and nothing else, resulting in a weird visual. How do I remove all data (resulting in no results found) if the only results are successes?
Found a really simple solution, feel dumb now. Just need to append | search error!=Success
index=......| eval error=if(apiHttpStatus!=200, apiErrorCode, "Success") | bin span=1m _time | stats count by _time, error | eventstats sum(count) as total by _time | eval perc=round((count*100)/total,2) | search error!=Success| timechart span=1m values(perc) by error
Found a really simple solution, feel dumb now. Just need to append | search error!=Success
index=......| eval error=if(apiHttpStatus!=200, apiErrorCode, "Success") | bin span=1m _time | stats count by _time, error | eventstats sum(count) as total by _time | eval perc=round((count*100)/total,2) | search error!=Success| timechart span=1m values(perc) by error