Plot error % as timeseries

[sudhakar_mnsr]

How to plot http error % as timeseries? (when I add _time or timeseries count Iam getting DAG: Execution exception (search cancelled)).

Query:

index=abc source=efg cdn=pqr "message.reqHost"="*xyz*" earliest=-15m latest=now

| eventstats count As Total

| eval Status=case(like(dm_status,"4%"),"HTTPERR", like(dm_status,"5%"),"HTTPERR") | stats count AS ERR_Count by Status, Total

| eval ERR_PERCENTAGE=round(((ERR_Count)/Total)*100,2)

| eval ERR_PERCENTAGE = if(isnull(ERR_PERCENTAGE),"0",ERR_PERCENTAGE)

[ITWhisperer]

Can you share the search that doesn't work as well as the one that does?

[sudhakar_mnsr]

Thanks for looking into this. Please find the query that give error

index=abc source=efg dm_cdn=pqr "message.reqHost"=xyz earliest=-15m latest=now

| eventstats count As Total

| eval Status=case(like(dm_status,"4%"),"HTTP4XX")| stats count AS ERR_Count by Status, Total, _time

| eval ERR_PERCENTAGE=round(((ERR_Count)/Total)*100,2)

| eval ERR_PERCENTAGE = if(isnull(ERR_PERCENTAGE),"0",ERR_PERCENTAGE) | fields _time, ERR_PERCENTAGE

| timechart span=10s count by ERR_PERCENTAGE

[ITWhisperer]

Which version of splunk are you using? Is there any useful information in the job inspector?

[sudhakar_mnsr]

Splunk Cloud (Version:8.2.2105.2).

Iam new to Splunk, if you can help me to get the information you are looking for, I can send it. However in verbose mode (events) I could not get any information.