How to plot http error % as timeseries? (when I add _time or timeseries count Iam getting DAG: Execution exception (search cancelled)).
Query:
index=abc source=efg cdn=pqr "message.reqHost"="*xyz*" earliest=-15m latest=now
| eventstats count As Total
| eval Status=case(like(dm_status,"4%"),"HTTPERR", like(dm_status,"5%"),"HTTPERR") | stats count AS ERR_Count by Status, Total
| eval ERR_PERCENTAGE=round(((ERR_Count)/Total)*100,2)
| eval ERR_PERCENTAGE = if(isnull(ERR_PERCENTAGE),"0",ERR_PERCENTAGE)
Can you share the search that doesn't work as well as the one that does?
Thanks for looking into this. Please find the query that give error
index=abc source=efg dm_cdn=pqr "message.reqHost"=xyz earliest=-15m latest=now
| eventstats count As Total
| eval Status=case(like(dm_status,"4%"),"HTTP4XX")| stats count AS ERR_Count by Status, Total, _time
| eval ERR_PERCENTAGE=round(((ERR_Count)/Total)*100,2)
| eval ERR_PERCENTAGE = if(isnull(ERR_PERCENTAGE),"0",ERR_PERCENTAGE) | fields _time, ERR_PERCENTAGE
| timechart span=10s count by ERR_PERCENTAGE
Which version of splunk are you using? Is there any useful information in the job inspector?
Splunk Cloud (Version:8.2.2105.2).
Iam new to Splunk, if you can help me to get the information you are looking for, I can send it. However in verbose mode (events) I could not get any information.