Percentage by field with search

[Idodox]

I'm trying to get a percentage of a field, based on a condition (filtered by search) by another field.

e.g.  percentage of 404 errors by application. So need to get the total number of requests for each application, filter to keep only 404 errors then count by application. At least that's the logic I used.

<unrelated part to collect proper events>
| eventstats count as total by applicationId
| search error=404
| stats count as error_404 by applicationId
| eval errorRate=((error_404/total)*100)."%"
| table applicationId, errorRate

This returns a list of applications, but no values for errorRate.
Individually, I'm able to get a result for this:

| stats count as total by applicationId

And also for this:

| search error=404
| stats count as error_404 by applicationId

But something in having them together in the flow I have doesn't work.

I also tried this which didn't work. In this instance I get values for applicationId and total. So I guess there's something wrong with how I'm getting the error_404 values.

| stats count as total by applicationId
| appendcols[search error=404|stats count as error_404 by applicationId]
| eval errorRate=((error_404/total)*100)."%"
| table applicationId, error_404, total, errorRate

[gcusello · Accepted solution]

Hi @Idodox ,

please see this approach:

<unrelated part to collect proper events> error=4
| eventstats count as total by applicationId
| search error=404
| stats count as error_404 values(total) AS total by applicationId
| eval errorRate=((error_404/total)*100)."%"
| table applicationId, errorRate

Ciao.

Giuseppe

[Idodox]

Works beautifully. Thank you!