How to timechart requests count with SLA and latency

[panandshah]

How to timechart requests count with SLA and latency based on the time mentioned in the logs. I need to know how many request ended within 50ms , 100 ms and 1 sec and the count of such request with percentage of contribution against the total request.

Sample Logs: Time is in seconds

10.30.2.154 [23/Nov/2017:14:59:49 +0530] "GET http://example.com/BYOD/besc/READSubHierarchyCount?channel=IOS&appVersion=5.23.1&categoryId=14846&gl... HTTP/1.1" 200 165 0.020027 miss - 75.156.33.2

10.30.1.91 [23/Nov/2017:14:59:49 +0530] "GET http://example.com/BYOD/besc/READAggregatedContentDetails?contentId=1000193399&appVersion=5.17.53&gl... HTTP/1.1" 200 1217 0.011564 miss - 71.59.21.249

10.30.3.143 [23/Nov/2017:14:59:49 +0530] "GET http://example.com/BYOD/besc/READSubHierarchyCount?channel=IOS&appVersion=5.23.1&categoryId=742&gl=C... HTTP/1.1" 200 164 0.019100 miss - 75.156.33.2

1. Calls that took lesser than <= 50ms , calls between 50 ms to 200 ms and 200ms to 500ms and 500 ms to 1 second.
2. Number of total request.
3. percentage of req contribution against total request.

Here is one example of the output desired.

<= 50ms >50 To <=100 ms >100 to <=200 ms
Count % Count % Count %
556567 96.609 15223 2.642 3724 0.646
468026 99.821 539 0.114 153 0.032
216127 99.847 192 0.088 66 0.030
251327 99.758 374 0.148 112 0.044

[lukas_loder]

1. | eval duration_group = if(duration<=50,"50ms",if(duration<=200,"200ms",if(duration<=500ms,"500ms","1s"))) so you have a new field_duration_group with that you can count
2. | eventstats count as totalCount this one gives you on every event a new field with the total count

now you just can calculate the percentage