Regex inside eval is not working

[pjtbasu]

I am trying to do a stats count where 2XX https response means as success and any non 2XX means that it's a failure. I am using below snippet. But it doesn't work. Am I missing something ?

stats  count(eval(httpresponse="2*")) as TRANSACTIONS_SUCCESS,  count(eval(httpresponse!="2*")) as TRANSACTIONS_FAILURE by service

[kamlesh_vaghela · Accepted solution]

@pjtbasu 

Can you please try this?

YOUR_SEARCH
| stats sum(eval(if(like(httpresponse,"2%"),1,0))) as TRANSACTIONS_SUCCESS, sum(eval(if(!like(httpresponse,"2%"),1,0))) as TRANSACTIONS_FAILURE by service

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.